Newsgroups: php.internals Path: news.php.net Xref: news.php.net php.internals:75571 Return-Path: Mailing-List: contact internals-help@lists.php.net; run by ezmlm Delivered-To: mailing list internals@lists.php.net Received: (qmail 47859 invoked from network); 16 Jul 2014 01:12:44 -0000 Received: from unknown (HELO lists.php.net) (127.0.0.1) by localhost with SMTP; 16 Jul 2014 01:12:44 -0000 Authentication-Results: pb1.pair.com header.from=ajf@ajf.me; sender-id=pass Authentication-Results: pb1.pair.com smtp.mail=ajf@ajf.me; spf=pass; sender-id=pass Received-SPF: pass (pb1.pair.com: domain ajf.me designates 192.64.116.200 as permitted sender) X-PHP-List-Original-Sender: ajf@ajf.me X-Host-Fingerprint: 192.64.116.200 imap1-2.ox.privateemail.com Received: from [192.64.116.200] ([192.64.116.200:56070] helo=imap1-2.ox.privateemail.com) by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP id 17/BB-15121-A81D5C35 for ; Tue, 15 Jul 2014 21:12:43 -0400 Received: from localhost (localhost [127.0.0.1]) by mail.privateemail.com (Postfix) with ESMTP id 0C14EB00081; Tue, 15 Jul 2014 21:12:40 -0400 (EDT) X-Virus-Scanned: Debian amavisd-new at imap1.ox.privateemail.com Received: from mail.privateemail.com ([127.0.0.1]) by localhost (imap1.ox.privateemail.com [127.0.0.1]) (amavisd-new, port 10024) with LMTP id aaFhhIIB1UPF; Tue, 15 Jul 2014 21:12:39 -0400 (EDT) Received: from [192.168.0.15] (unknown [90.210.122.167]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.privateemail.com (Postfix) with ESMTPSA id BD852B0007B; Tue, 15 Jul 2014 21:12:37 -0400 (EDT) Content-Type: text/plain; charset=windows-1252 Mime-Version: 1.0 (Mac OS X Mail 7.3 \(1878.6\)) In-Reply-To: Date: Wed, 16 Jul 2014 02:12:34 +0100 Cc: "internals@lists.php.net" Content-Transfer-Encoding: quoted-printable Message-ID: <61F23F13-DC8D-4C6B-A25C-E9B58B5EE602@ajf.me> References: To: Yasuo Ohgaki X-Mailer: Apple Mail (2.1878.6) Subject: Re: [PHP-DEV] crypt() BC issue From: ajf@ajf.me (Andrea Faulds) On 16 Jul 2014, at 01:46, Yasuo Ohgaki wrote: > - Developer may use larger rounds and store updated hash when > user is authenticated with old PHP. > - Developer may ask users to reset password if password hash has > to fewer rounds than 1000 (i.e. outdated hash) with new PHP. Wait, doesn=92t that mean you=92re unable to verify passwords now? -- Andrea Faulds http://ajf.me/