Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:94867
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain ethreal.net designates 209.85.218.50 as permitted sender)
MIME-Version: 1.0
Sender: charlesportwoodii@ethreal.net
In-Reply-To: <D3CA3C50.70BAD%fsb@thefsb.org>
References: <CAGC=tRnpka_ym=f-xsskjeiPaqahsTEAxPq9=E8Z73KQKeRrHg@mail.gmail.com>
 <81b5a129-9c90-0a54-921f-7e1f9b5f727f@thefsb.org> <CAGC=tR=4v0KAkqnU1Q3Fr5AeM8o_PuJfP9rYQ_s4X3=Z9UUh=w@mail.gmail.com>
 <CAObuZdsq33=g4wG=FP0bOHnsE9N+PrCu3nGs7ZNAxx=rX4dJ+w@mail.gmail.com>
 <CAGC=tRkw3u0=ufjALKvF6YpahLE6H05T0vFBHyHPCM4aR1siCw@mail.gmail.com> <D3CA3C50.70BAD%fsb@thefsb.org>
Date: Fri, 5 Aug 2016 13:20:57 -0500
Message-ID: <CAGC=tRnKgD=r8pSc1KVPahC2Xx=BYDV+M=55eQ0GfMQSVgr97Q@mail.gmail.com>
To: Tom Worster <fsb@thefsb.org>
Cc: Ryan Pallas <derokorian@gmail.com>, PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a11494faef0eaef053957211f
Subject: Re: [PHP-DEV] Re: [RFC][DISCUSSION] Argon2 Password Hash
From: charlesportwoodii@erianna.com ("Charles R. Portwood II")

--001a11494faef0eaef053957211f
Content-Type: text/plain; charset=UTF-8

On Fri, Aug 5, 2016 at 12:12 PM, Tom Worster <fsb@thefsb.org> wrote:
>
> I can understand an argument that it's too much to expect a user to
> provide an options array when using Argon2. But I don't understand how my
> suggestion breaks BC. In my idea, a future RFC would propose default cost
> constants. Changing PASSWORD_DEFAULT to PASSWORD_ARGON2I depends on those
> constants so they would need to be defined before changing
> PASSWORD_DEFAULT or at the same time. So...
>
> password_hash('password', PASSWORD_DEFAULT) will always work.
>
> password_hash('password', PASSWORD_ARGON2I) works as soon as Argon2 is
> introduced in your proposal, but has to wait for another future RFC in my
> suggested change.
>
> password_hash('password', PASSWORD_ARGON2I, [costs]) will always work.
>
> How does a BC break happen?
>
> Tom
>

Hi Tom,

It breaks the API in the interim between this RFC and a potential future
one. The $options parameter for both password_hash and
password_needs_rehash is optional. Making it required for one algorithm but
not another changes the API's for both methods. The expectations outlined
in the original password_hash RFC make the third parameter for tuning the
algorithm, not for making the algorithm work. Without default values, both
password_hash and password_needs_rehash would fail unless the costs are
provided.

Hi Niklas,

People knowing the reference library will probably recognize `memory_cost`
> and `time_cost`, but this is a simple API targeted on a large audience.
> Most users of it won't know the reference library's internals.


If that's going to be easier for people I'm all for it.

--001a11494faef0eaef053957211f--