Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:88863
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.220.50 as permitted sender)
MIME-Version: 1.0
References: <CAAyV7nGLiGC_E1YYc21chGSKdUJm1KpZV9V3_rZn5eHOmyEarA@mail.gmail.com>
In-Reply-To: <CAAyV7nGLiGC_E1YYc21chGSKdUJm1KpZV9V3_rZn5eHOmyEarA@mail.gmail.com>
Date: Sun, 18 Oct 2015 23:06:56 +0000
Message-ID: <CANeXGWU-XHbi9HbP=Z6h3G+6G+D9t3OXfmF4hY7P8vcaFWxtcA@mail.gmail.com>
To: Anthony Ferrara <ircmaxell@gmail.com>, 
	"internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=047d7b6dcd6e6858e3052269169e
Subject: Re: [PHP-DEV] Password_hash salt generation refactor
From: korvinszanto@gmail.com (Korvin Szanto)

--047d7b6dcd6e6858e3052269169e
Content-Type: text/plain; charset=UTF-8

+1 for 7.0.x security patch release, best effort sounds scary.
On Sun, Oct 18, 2015 at 4:01 PM Anthony Ferrara <ircmaxell@gmail.com> wrote:

> All,
>
> With PHP 7 comes random_bytes and random_int. This duplicates some of
> the logic internally that password_hash uses to generate its salt.
>
> I would like to refactor this to unify generation. I've opened a PR
> against master: https://github.com/php/php-src/pull/1585
>
> I don't feel comfortable pulling against 7 this far into RC status.
> Perhaps wait until after it goes gold? Or should this target 7.1? It's
> not a big deal in either direction. Though it does add a side-effect,
> where if it can't gather enough entropy it will throw an exception and
> return failure (where prior it would simply make a "best effort".
>
> Thoughts?
>
> Anthony
>
> --
> PHP Internals - PHP Runtime Development Mailing List
> To unsubscribe, visit: http://www.php.net/unsub.php
>
>

--047d7b6dcd6e6858e3052269169e--