Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:90467
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 74.125.82.51 as permitted sender)
References: <CAKws9z1g24rD=t92+9xKtO=3PuwQ3_N=L36gmVMqCC84CoqipQ@mail.gmail.com>
 <CAEZPtU7-Lk=jGsTQgRZOvBpcPPgdX3V-23=3_k9CXbmxU77V1A@mail.gmail.com>
 <CAKws9z248Kj=0qTLPZik0Ki1_zGPq+4fr6HQi_keeVCso1S4eQ@mail.gmail.com>
 <5692CDB6.5050905@gmail.com>
 <CAKws9z1e_+XOzsojz9gW-zzswhaK7h+HothhTWWVSvDQXri2zA@mail.gmail.com>
To: PHP Internals <internals@lists.php.net>
Message-ID: <5692D424.2010908@gmail.com>
Date: Sun, 10 Jan 2016 21:59:00 +0000
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101
 Thunderbird/38.5.0
MIME-Version: 1.0
In-Reply-To: <CAKws9z1e_+XOzsojz9gW-zzswhaK7h+HothhTWWVSvDQXri2zA@mail.gmail.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] [RFC] Libsodium
From: rowan.collins@gmail.com (Rowan Collins)

On 10/01/2016 21:41, Scott Arciszewski wrote:
> Hi Rowan,
>
>> >I think what people are suggesting is not that libsodium shouldn't be
>> >supported under-the-hood, just that the fact you're using it shouldn't be
>> >exposed to userland.
> These are separate concerns. Let's call them Sodium and SimpleSodium.
>
> With Sodium, power users gain the ability to write software that
> directly uses low-level primitives in PHP without requiring their
> users to install dependencies (i.e. from PECL). [
>
> SimpleSodium is a driver for the simple cryptography wrapper.

As noted on the other thread, I think what people are looking for is 
actually somewhere between the two - something for power users to use 
*without tying their code to libsodium*. Code written using mcrypt_* 
functions is now facing an annoying upgrade path; code written with 
sodium_* functions now may face the same some years in the future, who 
knows?

PHP should not be maintaining its own low-level implementations of 
crypto, but it should seem to the user as though it does - they should 
be asking PHP for a particular cipher / mode / etc, not asking libsodium 
for one via a thin PHP wrapper.


> You can have SimpleSodium without Sodium, but if we don't get Sodium into core
> I will, personally, not be putting forth one more ounce of time or
> effort into helping the PHP core so who knows maybe not?

Obviously, this is entirely your prerogative, but it seems quite a 
black-and-white stance - maybe leave a bit of leeway for understanding 
other people's concerns before threatening to abandon work which would 
be very much appreciated.

Regards,

-- 
Rowan Collins
[IMSoP]