Hi all,
I'd like to gather opinions on the possibility of switching
PASSWORD_DEFAULT from bcrypt to Argon2id.
A few reasons to do so:
- bcrypt has a limit of (and silently truncates at) 72 bytes, which may
seem like an acceptable thing at first glance, but does cause many headaches - Argon2 is superior in every way and widely recognized as the gold
standard today; I've even encountered people who mistakenly believed it is
already PHP's default - While both algorithms are (by today's understanding) considered safe from
quantum threat, Argon2's memory hardness makes it future-proof by design
But there is one contentious circumstance - bcrypt is entirely bundled with
PHP, while Argon2 has external dependencies: libargon2, libsodium, or
(since PHP 8.4) openssl. The addition of OpenSSL is key, because it's the
most ubiquitous and a practical must for almost any environment, IMO making
changing PASSWORD_DEFAULT viable. But am I right to think that, or is any
external dependency likely to kill the proposal? That's what I want to
gauge before fleshing out an RFC with the greater detail it deserves.
Cheers,
Andrey.
But there is one contentious circumstance - bcrypt is entirely bundled with PHP, while Argon2 has external dependencies: libargon2, libsodium, or (since PHP 8.4) openssl.
This is both a con and pro. Using a crypto library instead of a roll-your-own solution seems a very wise decision to me. Not to say that I don't trust the php bcrypt implementation. Just saying this as a general rule.
Greetings, Casper
Hi all,
I'd like to gather opinions on the possibility of switching
PASSWORD_DEFAULTfrom bcrypt to Argon2id.A few reasons to do so:
- bcrypt has a limit of (and silently truncates at) 72 bytes, which may
seem like an acceptable thing at first glance, but does cause many headaches- Argon2 is superior in every way and widely recognized as the gold
standard today; I've even encountered people who mistakenly believed it
is already PHP's default- While both algorithms are (by today's understanding) considered safe
from quantum threat, Argon2's memory hardness makes it future-proof by
designBut there is one contentious circumstance - bcrypt is entirely bundled
with PHP, while Argon2 has external dependencies: libargon2, libsodium,
or (since PHP 8.4) openssl. The addition of OpenSSL is key, because it's
the most ubiquitous and a practical must for almost any environment, IMO
making changingPASSWORD_DEFAULTviable. But am I right to think that,
or is any external dependency likely to kill the proposal? That's what I
want to gauge before fleshing out an RFC with the greater detail it
deserves.Cheers,
Andrey.
Hi Andrey
Did anything change since the last time?
https://externals.io/message/120993#120996
--
Anton
Hi Anton,
Did anything change since the last time?
Yes, that thread is from September 2023, more than a year before PHP 8.4's
release bringing in the --with-openssl-argon2 flag.
libargon2 and libsodium can't be relied upon to exist on most systems, but
openssl is a very different beast.
There already exists a year-old proposal to enable --with-openssl-argon2 by
default (https://github.com/php/php-src/pull/19360). It would be fair to
point out that I am thinking ahead of it, this is exploring potential and
there are plenty of subsequent problems to debate after. But whether the
openssl dependency is acceptable is the most critical one.
Cheers,
Andrey.