Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:87631
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.220.54 as permitted sender)
To: Scott Arciszewski <scott@paragonie.com>,
 =?UTF-8?Q?Lauri_Kentt=c3=a4?= <lauri.kentta@gmail.com>
References: <CAKws9z1fatmSR2YLaeBn0zVv-s3iwCj7OUKjW949QC0L_VndpA@mail.gmail.com>
 <9996b5784a1bfbca80b07de01f1a7a94@k-piste.dy.fi>
 <CAKws9z3r6dQ1BQaA5Q9kQNpNu11M+EJ+LS7DwGZxajnfXmLYFg@mail.gmail.com>
Cc: PHP Internals <internals@lists.php.net>
Message-ID: <55C15472.4020108@gmail.com>
Date: Tue, 4 Aug 2015 17:10:26 -0700
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:38.0)
 Gecko/20100101 Thunderbird/38.1.0
MIME-Version: 1.0
In-Reply-To: <CAKws9z3r6dQ1BQaA5Q9kQNpNu11M+EJ+LS7DwGZxajnfXmLYFg@mail.gmail.com>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] PHP 7.1 Cryptography Projects
From: smalyshev@gmail.com (Stanislav Malyshev)

Hi!

> We're still discussing the DSN string for the constructor. These are
> what the options look like, currently:

I think it's better to separate the arguments. I understand why PDO
makes such strings - there can be all kinds of options, and it's hard to
configure - i.e. in ini files - if it's not a single string. However, I
think in this case it's less of a concern, and while composing this
string it's too easy to make a mistake with bad consequences.

> * "openssl" should use openssl in a secure, sane default

That's kind of open-ended... Secure, sane default to do what?

> Version and configuration information (not what is passed, but what is
> used) will be stored in the first few bytes of ciphertext output.

That means new cyphertext format. Which makes these functions
incompatible with every other encryption/decryption functions out there
(i.e., if you talk to Java app using these functions, you'd have to
implement your own decryption routines in Java too). Is that really a
good idea?

-- 
Stas Malyshev
smalyshev@gmail.com