Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:75694
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.219.42 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAGa2bXbyRGWhtgu9t-D=qcf6nkBYHUNBpyfgCXkMLmFsgwcwuQ@mail.gmail.com>
References: <CAGa2bXYP4L-EVjqiTvrOjbiRvzQJ7zyTQyu78O1AEEkk7nwEhQ@mail.gmail.com>
	<CAGa2bXbyRGWhtgu9t-D=qcf6nkBYHUNBpyfgCXkMLmFsgwcwuQ@mail.gmail.com>
Date: Sat, 19 Jul 2014 07:46:22 +0200
Message-ID: <CAF+90c-dZcDwrP=FosSR9=8RZdqWNTiP1y6t=E=m66FmV8u-9Q@mail.gmail.com>
To: Yasuo Ohgaki <yohgaki@ohgaki.net>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=089e0115ea30d84a1d04fe856437
Subject: Re: [PHP-DEV] Re: crypt() BC issue
From: nikita.ppv@gmail.com (Nikita Popov)

--089e0115ea30d84a1d04fe856437
Content-Type: text/plain; charset=UTF-8

On Sat, Jul 19, 2014 at 4:15 AM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:

> Hi all,
>
> On Wed, Jul 16, 2014 at 9:46 AM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
>
> > crypt() has BC issue with older systems.
> >
> > https://bugs.php.net/bug.php?id=62372&edit=1
> >
> > The reason rounds became 1000 from 10 is hardcoded lower limit for newer
> > PHPs.
> > Generally speaking, developer should never use less than 1000 rounds and
> > better to have
> > at least few thousands rounds or more, tens of thousands or more is
> > recommended.
> >
> > I would like to make this bug report 'wont fix', since migration is
> > possible.
> >
> >  - Developer may use larger rounds and store updated hash when
> >    user is authenticated with old PHP.
> >  - Developer may ask users to reset password if password hash has
> >    to fewer rounds than 1000 (i.e. outdated hash) with new PHP.
> >
> > Any comments?
> >
>
> I'm not going to touch crypt(), but password_hash() behavior that truncates
> byte larger than 72
> silently is not good.
>
> I made a bug report for this to add E_NOTICE.
> https://bugs.php.net/bug.php?id=67653
>
> Any comments? If not, I'll add E_NOTICE in a few days.
>

I'm against adding this notice to password_hash. This will require all
applications to ensure that passwords are shorter than 72 chars. I don't
think that's a good idea.

Nikita

--089e0115ea30d84a1d04fe856437--