Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:88864
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.160.176 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAAyV7nGLiGC_E1YYc21chGSKdUJm1KpZV9V3_rZn5eHOmyEarA@mail.gmail.com>
References: <CAAyV7nGLiGC_E1YYc21chGSKdUJm1KpZV9V3_rZn5eHOmyEarA@mail.gmail.com>
Date: Sun, 18 Oct 2015 19:18:31 -0400
Message-ID: <CAL+t6cGyXzNwYQqQJrSH98d7TZGQ+hGTwAcCs_m2Rq=+VFZhKw@mail.gmail.com>
To: Anthony Ferrara <ircmaxell@gmail.com>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a11490ee23b02550522693fea
Subject: Re: [PHP-DEV] Password_hash salt generation refactor
From: theanomaly.is@gmail.com (Sherif Ramadan)

--001a11490ee23b02550522693fea
Content-Type: text/plain; charset=UTF-8

If I'm understanding this correctly, this change doesn't effect actual
behavior, right? It's just taking advantage of reusing code for
random_bytes / random_int ?

If that is true I don't think it much matters whether the change goes
through 7.0 or 7.1 since it has no real end-user impact.

On Sun, Oct 18, 2015 at 6:59 PM, Anthony Ferrara <ircmaxell@gmail.com>
wrote:

> All,
>
> With PHP 7 comes random_bytes and random_int. This duplicates some of
> the logic internally that password_hash uses to generate its salt.
>
> I would like to refactor this to unify generation. I've opened a PR
> against master: https://github.com/php/php-src/pull/1585
>
> I don't feel comfortable pulling against 7 this far into RC status.
> Perhaps wait until after it goes gold? Or should this target 7.1? It's
> not a big deal in either direction. Though it does add a side-effect,
> where if it can't gather enough entropy it will throw an exception and
> return failure (where prior it would simply make a "best effort".
>
> Thoughts?
>
> Anthony
>
> --
> PHP Internals - PHP Runtime Development Mailing List
> To unsubscribe, visit: http://www.php.net/unsub.php
>
>

--001a11490ee23b02550522693fea--