Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:94463
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain kelunik.com from 81.169.146.221 cause and error)
MIME-Version: 1.0
In-Reply-To: <CAGC=tRnLpcDSQXmPYO3yWeuDnKNqNAT0RMVrxp1We5eHwPprbg@mail.gmail.com>
References: <CAGC=tR=hPyeQkwY5Bru-psN-5ebpeafox3CEyh-u9haLNbFVpg@mail.gmail.com>
 <CAEZPtU4pkJJ7DD88XeZCCy9GZ2PAPw_bR2b3QN1fec14txGAhw@mail.gmail.com>
 <CAEZPtU6E9JGHuxWdOSQMpSWS29Mu69rDVFSmaySWoB-t4rS5zg@mail.gmail.com>
 <CAEZPtU6m3VqLp20iqjvQ-cWcM_BR2M5TYCq2-=Zpa_n+js-2vg@mail.gmail.com>
 <CAKws9z3M3ESy9T0sQ1_zdv1hr3BasK-ykCwfCDhxHfDwdQu6xQ@mail.gmail.com> <CAGC=tRnLpcDSQXmPYO3yWeuDnKNqNAT0RMVrxp1We5eHwPprbg@mail.gmail.com>
Date: Mon, 11 Jul 2016 09:23:19 +0200
Message-ID: <CANUQDCj8K2P4ibVgJi7b428sLCoQbfeH4yr_ecpXprnWbMa-4Q@mail.gmail.com>
To: "Charles R. Portwood II" <charlesportwoodii@erianna.com>
Cc: Scott Arciszewski <scott@paragonie.com>, Pierre Joye <pierre.php@gmail.com>, 
	PHP internals <internals@lists.php.net>, Joe Watkins <pthreads@pthreads.org>
Content-Type: multipart/alternative; boundary=001a1146e5dedf930d053757062d
Subject: Re: [PHP-DEV] Request for wiki karma
From: me@kelunik.com (Niklas Keller)

--001a1146e5dedf930d053757062d
Content-Type: text/plain; charset=UTF-8

2016-07-10 21:27 GMT+02:00 Charles R. Portwood II <
charlesportwoodii@erianna.com>:

> On Sun, Jul 10, 2016 at 12:36 AM, Scott Arciszewski <scott@paragonie.com>
> wrote:
>
> > Version 1.3 of the Argon2 spec alleviated my concerns.
> >
> > I never completed my patch, and the past couple of months have been
> > hectic. I can review the patch before it's merged if you want, but I
> still
> > don't have the free time to author an alternative.
> >
> > If accepted in 7.1, I believe it can be the new PASSWORD_DEFAULT in 7.3
> if
> > it remains the best option.
> >
> > Scott Arciszewski
> > Chief Development Officer
> > Paragon Initiative Enterprises <https://paragonie.com>
> >
> > On Sun, Jul 10, 2016 at 1:24 AM, Pierre Joye <pierre.php@gmail.com>
> wrote:
> >
> >>
> >> On Jul 10, 2016 2:38 AM, "Charles R. Portwood II" <
> >> charlesportwoodii@erianna.com> wrote:
> >> >
> >> > Hello Internals,
> >> >
> >> > I'd like to improve the password_* functions by adding support for
> >> > Argon2[1], the winner of the Password Hasing Competition[2].
> >> >
> >> > I've previously implemented an extension[3] to handle this, however I
> >> > believe this would be better to have Argon2 implemented directly
> >> password_*
> >> > functions. I would handle implementation of this enhancement, and
> would
> >> > like to gather your feedback before formally proposing an RFC.
> >> >
> >> > My wiki username is: charlesportwoodii
> >> >
> >> > Thank you!
> >> > *Charles R. Portwood II*
> >> >
> >> > [1] <https://github.com/P-H-C/phc-winner-argon2>
> >> > [2] <https://password-hashing.net/>
> >> > [3] <https://github.com/charlesportwoodii/php-argon2-ext>
> >>
> >> Hi Charles,
> >>
> >> Nice work already.
> >>
> >> I add Scott to this thread to be sure he reads. As far as I remember he
> >> has a patch too but there was concerns about having argon2 support at
> this
> >> stage because of the current state of argon2 specs (or something along
> this
> >> line).
> >>
> >> Let be sure that these concerns are solved before considering to include
> >> it as it means some bc risks later if the specs change.
> >>
> >> Cheers
> >> Pierre
> >>
> >
> >
> Thanks for your feedback everyone (and for granting wiki access)!
>
> This implementation would be against the version 1.3 of the Argon2
> reference library. As Scott mentioned, this proposal would be for inclusion
> on 7.1, and then made PASSWORD_DEFAULT in 7.3 per the password_hash RFC,
> assuming better option does not arise.
>
> I'll provide an RFC within the coming days which will outline everything in
> detail.
>
> Thanks again,
>
> *Charles R. Portwood II*


Hi Charles,

it will probably have to target 7.2 as 7.1 has feature freeze in less then
two weeks IIRC.

Regards, Niklas

--001a1146e5dedf930d053757062d--