Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:94858
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain ethreal.net designates 209.85.218.45 as permitted sender)
MIME-Version: 1.0
Sender: charlesportwoodii@ethreal.net
In-Reply-To: <CAGC=tR=4v0KAkqnU1Q3Fr5AeM8o_PuJfP9rYQ_s4X3=Z9UUh=w@mail.gmail.com>
References: <CAGC=tRnpka_ym=f-xsskjeiPaqahsTEAxPq9=E8Z73KQKeRrHg@mail.gmail.com>
 <81b5a129-9c90-0a54-921f-7e1f9b5f727f@thefsb.org> <CAGC=tR=4v0KAkqnU1Q3Fr5AeM8o_PuJfP9rYQ_s4X3=Z9UUh=w@mail.gmail.com>
Date: Fri, 5 Aug 2016 09:59:59 -0500
Message-ID: <CAGC=tRkXOMyy-VuTxMYx3rkupbd1fVhg9FJHW3afyR5N1_UfaA@mail.gmail.com>
To: Tom Worster <fsb@thefsb.org>
Cc: PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a1135334c35999c0539545338
Subject: Re: [RFC][DISCUSSION] Argon2 Password Hash
From: charlesportwoodii@erianna.com ("Charles R. Portwood II")

--001a1135334c35999c0539545338
Content-Type: text/plain; charset=UTF-8

On Fri, Aug 5, 2016 at 9:49 AM, Charles R. Portwood II <
charlesportwoodii@erianna.com> wrote:

> On Fri, Aug 5, 2016 at 9:19 AM, Tom Worster <fsb@thefsb.org> wrote:
>
>> On 8/5/16 8:47 AM, Charles R. Portwood II wrote:
>>
>> The RFC is available at: https://wiki.php.net/rfc/argon2_password_hash
>>>
>>> .
>>>
>>
>> Hi Charles,
>>
>> Thanks for doing this. I'm glad Argon2 is coming to PHP.
>
>
> As the spec requires some minimum values to even work (and there's
> recommendations from the developers [1]), I think we should be providing
> defaults so that the algorithm works out of the box, though I agree they
> could be set to lower values. Note that the spec does specifically say that
> there is no "insecure" value for the memory and time cost attributes. If we
> wanted to drop it to the minimum recommend by the developers, the values
> would be:
>
> m_cost = 16
> t_cost = 2
> threads = 1
>
> I'm open to other suggestions or alternatives though.
>
> Thanks,
> *Charles R. Portwood II*
>
> [1]: https://github.com/P-H-C/phc-winner-argon2/issues/144
>
>
For clarity, a memory cost of 16 implies 65536 KiB, or 64 MiB of memory.
The only difference between the values recommended by the developers, and
the cost outlined in the RFC is that the t_cost is set to 3.

*Charles R. Portwood II*

--001a1135334c35999c0539545338--