Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:94866
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain kelunik.com from 81.169.146.221 cause and error)
MIME-Version: 1.0
In-Reply-To: <CAGC=tRkw3u0=ufjALKvF6YpahLE6H05T0vFBHyHPCM4aR1siCw@mail.gmail.com>
References: <CAGC=tRnpka_ym=f-xsskjeiPaqahsTEAxPq9=E8Z73KQKeRrHg@mail.gmail.com>
 <81b5a129-9c90-0a54-921f-7e1f9b5f727f@thefsb.org> <CAGC=tR=4v0KAkqnU1Q3Fr5AeM8o_PuJfP9rYQ_s4X3=Z9UUh=w@mail.gmail.com>
 <CAObuZdsq33=g4wG=FP0bOHnsE9N+PrCu3nGs7ZNAxx=rX4dJ+w@mail.gmail.com> <CAGC=tRkw3u0=ufjALKvF6YpahLE6H05T0vFBHyHPCM4aR1siCw@mail.gmail.com>
Date: Fri, 5 Aug 2016 19:51:11 +0200
Message-ID: <CANUQDCiha7pW8jHXFxhMCFJkR7pNKAv5L=epRpfZkKT0mWwBQw@mail.gmail.com>
To: "Charles R. Portwood II" <charlesportwoodii@erianna.com>
Cc: Ryan Pallas <derokorian@gmail.com>, Tom Worster <fsb@thefsb.org>, 
	PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=047d7ba97a104f9b62053956b632
Subject: Re: [PHP-DEV] Re: [RFC][DISCUSSION] Argon2 Password Hash
From: me@kelunik.com (Niklas Keller)

--047d7ba97a104f9b62053956b632
Content-Type: text/plain; charset=UTF-8

2016-08-05 18:36 GMT+02:00 Charles R. Portwood II <
charlesportwoodii@erianna.com>:

> On Fri, Aug 5, 2016 at 10:08 AM, Ryan Pallas <derokorian@gmail.com> wrote:
> >
> >
> > I think this is the most important part to consider. If you make $options
> > required for this algo, then making this algo the PASSWORD_DEFAULT would
> > mean that its a backwards incompatible change, because now all calls to
> > password_hash($password, PASSWORD_DEFAULT) would need to be updated to
> use
> > an older constant or pass in $options which I think totally defeats the
> > purpose of the password_hash API.
> >
> > Please keep it so that defaults will work, but $options is available for
> > tuning as that's how the feature currently works.
> >
>
>
>
> > The rationale for providing defaults is to ensure the password_*
> >> functions remain easy to use.
> >
> >
>
> I understand. I was actually suggesting that we deliberately make it
> > harder to use!
>
>
> Assuming that at some point PASSWORD_ARGON2I (or any new algorithm)
> >> would become PASSWORD_DEFAULT, the end user's expectations would be that
> >> password_hash($password, PASSWORD_DEFAULT) just works, without needing
> to
> >> specify additional arguments.
> >
> >
>
> I agree entirely. I'm not against introducing default cost constants. I am
> > instead proposing we allow a period of time after introduction of Argon2
> > into PHP before deciding what the default costs should be and define the
> > constants at the same time as setting PASSWORD_DEFAULT =
> PASSWORD_ARGON2I,
> > or possibly before.
>
>
> > Please reread my previous message for the reasons behind this (odd, I
> > admit) idea.
>
>
> Hi Tom,
>
> I understand what you're saying. Ryan said it a bit more clearly than I
> did, making the options required causes backwards-incompatible changes to
> the password_hash API. That's my real reservation behind not providing
> defaults.
>
> A separate RFC would be needed for 7.4 to make PASSWORD_ARGON2I =
> PASSWORD_DEFAULT). If the supplied constants need to be changed for that, I
> think that would be the time to do so. I think for now something needs to
> be provided to ensure the password_hash API doesn't change.
>
> On Fri, Aug 5, 2016 at 11:29 AM, Niklas Keller <me@kelunik.com> wrote:
> >
> > Hi Charles,
> >
> > I'd prefer `memory_cost` and `time_cost` over `m_cost` and `t_cost`. Do
> we
> > have any reason to use the shorter but less readable names here?
> >
> > Regards, Niklas
> >
>
> 'm_cost' and 't_cost' is what is used in the reference library. Someone
> looking at the reference material would see those names.


People knowing the reference library will probably recognize `memory_cost`
and `time_cost`, but this is a simple API targeted on a large audience.
Most users of it won't know the reference library's internals.

Regards, Niklas

--047d7ba97a104f9b62053956b632--