Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:75693
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.217.176 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <CAGa2bXYP4L-EVjqiTvrOjbiRvzQJ7zyTQyu78O1AEEkk7nwEhQ@mail.gmail.com>
References: <CAGa2bXYP4L-EVjqiTvrOjbiRvzQJ7zyTQyu78O1AEEkk7nwEhQ@mail.gmail.com>
Date: Sat, 19 Jul 2014 11:15:01 +0900
Message-ID: <CAGa2bXbyRGWhtgu9t-D=qcf6nkBYHUNBpyfgCXkMLmFsgwcwuQ@mail.gmail.com>
To: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a11346e5e5f39ff04fe8273f5
Subject: Re: crypt() BC issue
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--001a11346e5e5f39ff04fe8273f5
Content-Type: text/plain; charset=UTF-8

Hi all,

On Wed, Jul 16, 2014 at 9:46 AM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:

> crypt() has BC issue with older systems.
>
> https://bugs.php.net/bug.php?id=62372&edit=1
>
> The reason rounds became 1000 from 10 is hardcoded lower limit for newer
> PHPs.
> Generally speaking, developer should never use less than 1000 rounds and
> better to have
> at least few thousands rounds or more, tens of thousands or more is
> recommended.
>
> I would like to make this bug report 'wont fix', since migration is
> possible.
>
>  - Developer may use larger rounds and store updated hash when
>    user is authenticated with old PHP.
>  - Developer may ask users to reset password if password hash has
>    to fewer rounds than 1000 (i.e. outdated hash) with new PHP.
>
> Any comments?
>

I'm not going to touch crypt(), but password_hash() behavior that truncates
byte larger than 72
silently is not good.

I made a bug report for this to add E_NOTICE.
https://bugs.php.net/bug.php?id=67653

Any comments? If not, I'll add E_NOTICE in a few days.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--001a11346e5e5f39ff04fe8273f5--