Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:94944
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain ethreal.net designates 209.85.218.42 as permitted sender)
MIME-Version: 1.0
Sender: charlesportwoodii@ethreal.net
In-Reply-To: <CAGC=tRnpka_ym=f-xsskjeiPaqahsTEAxPq9=E8Z73KQKeRrHg@mail.gmail.com>
References: <CAGC=tRnpka_ym=f-xsskjeiPaqahsTEAxPq9=E8Z73KQKeRrHg@mail.gmail.com>
Date: Mon, 8 Aug 2016 12:18:00 -0500
Message-ID: <CAGC=tRm6VgqeNyq3hyhKMZK8SN_-npdBQmfn=RmDdQLXt05YOQ@mail.gmail.com>
To: PHP internals <internals@lists.php.net>, jared.williams1@ntlworld.com
Content-Type: multipart/alternative; boundary=001a11418fc25e0b2c0539929a0c
Subject: Re: [RFC][DISCUSSION] Argon2 Password Hash
From: charlesportwoodii@erianna.com ("Charles R. Portwood II")

--001a11418fc25e0b2c0539929a0c
Content-Type: text/plain; charset=UTF-8

>
> Argon2 also supports keyed hashes and associated data, but seen no
> mention of either.
> Jared


Hi Jared,

This is a design decision to prevent changing the PHP API.

The Argon2 reference library exposes two ways of working with Argon2
hashes, we can either use the Argon2_Context struct, or pass our data
directly to the argon2_hash/verify functions. The former is the only way to
provided a hash key and associated data.

Since password_hash doesn't expose the salt is generates, and since
password_verify doesn't accept an array options, it would be impossible to
verify Argon2 hashes created with a hash key and associated data without
changing the PHP API for that function.

*Charles R. Portwood II*

--001a11418fc25e0b2c0539929a0c--