# [RFC][VOTE] Password Digest Mechanism Registry

- Thread: https://externals.io/message/103426
- Original archive: https://news-web.php.net/php.internals/103426
- Started by Sara Golemon on 2018-11-06T16:58:46+00:00
- Messages: 3
- RFC: Password Hash Registry (Implemented (PHP 7.4)) — https://externals.io/rfc/password_registry.md
- Reply by email to internals@lists.php.net
- More for agents: search with https://externals.io/search.md?q={query} · RFCs at https://externals.io/rfc.md · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt

---

## #103426 — Sara Golemon — 2018-11-06T16:58:46+00:00

URL: https://externals.io/message/103426#103426

There's been no further discussion about password digest registry
after the initial post on 15 Oct despite a reminder post a week later,
so I'm going to go ahead and move the RFC into voting.
https://wiki.php.net/rfc/password_registry

Reminder that this RFC is mostly non user facing, it just provides
mechanisms for extensions to register hashing handlers for the
password_*() functions.  The primary user-facing effect of this is
that password scheme identifiers have changed.  There is a secondary
question on the RFC to address the BC impact of this.

-Sara

---

## #103427 — Christoph M. Becker — 2018-11-06T17:40:51+00:00

URL: https://externals.io/message/103426#103427 · In reply to: #103426

> Reminder that this RFC is mostly non user facing, it just provides
> mechanisms for extensions to register hashing handlers for the
> password_*() functions.  The primary user-facing effect of this is
> that password scheme identifiers have changed.  There is a secondary
> question on the RFC to address the BC impact of this.

If we overload `password_hash()` and `password_needs_rehash()` to also
accept integers as $algo, shouldn't passing ints be deprecated right away?

-- 
Christoph M. Becker

---

## #103428 — Sara Golemon — 2018-11-06T19:47:02+00:00

URL: https://externals.io/message/103426#103428 · In reply to: #103427

>
> 
>
> > […]
>
> If we overload `password_hash()` and `password_needs_rehash()` to also
> accept integers as $algo, shouldn't passing ints be deprecated right away?
>
I would take the deprecation notice as a given, but yeah I'll add that
to the text.

-Sara