Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:94854
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain ethreal.net designates 209.85.218.45 as permitted sender)
MIME-Version: 1.0
Sender: charlesportwoodii@ethreal.net
Date: Fri, 5 Aug 2016 07:47:56 -0500
Message-ID: <CAGC=tRnpka_ym=f-xsskjeiPaqahsTEAxPq9=E8Z73KQKeRrHg@mail.gmail.com>
To: PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=94eb2c09cb82f5097b0539527a9f
Subject: [RFC][DISCUSSION] Argon2 Password Hash
From: charlesportwoodii@erianna.com ("Charles R. Portwood II")

--94eb2c09cb82f5097b0539527a9f
Content-Type: text/plain; charset=UTF-8

Hello Internals,

Due to a couple issue with the original RFC's scope, the RFC for
introducing Argon2 as an alternative hashing algorithm for the password_*
functions was closed shortly after starting on Monday.

The following details were adjusted. and I would appreciate your feedback
before re-opening the vote.

   - The RFC scope was reduced to only cover inclusion in 7.2. This RFC no
   longer proposes changes to PASSWORD_DEFAULT in 7.4.
   - Argon2d is not suitable for password hashing, and has been removed to
   keep in line with the scope goals of the password_* functions.
   - The configure flag was changed to --with-argon2 to
   --with-password-argon2 to further clarify the scope of this RFC.

Further rationale for these items is provided in the RFC itself.

The RFC is available at: https://wiki.php.net/rfc/argon2_password_hash.

Thanks to those who emailed me directly to discuss the matter on Monday,
and for your feedback on these changes.

*Charles R. Portwood II*

--94eb2c09cb82f5097b0539527a9f--