Date: Wed, 27 Jun 2012 15:00:55 +0400 From: Solar Designer <solar@...nwall.com> To: crypt-dev@...ts.openwall.com Subject: Re: Simplified PHP Password Hashing Hi Anthony, all - On Tue, Jun 26, 2012 at 11:30:21AM -0400, Anthony Ferrara wrote: > I've recently been working on an RFC to add a simplified PHP password > hashing API to PHP's core. I was hoping for some feedback, and a code > review of the implementation. > > https://wiki.php.net/rfc/password_hash > > https://github.com/ircmaxell/php-src/blob/hash_password/ext/standard/password.c > > It's still a work in progress, but I wanted to reach out for input and > review prior to moving too far forward. Thanks. I've just provided a relevant reply here: http://news.php.net/php.internals/60977 Unfortunately, I don't expect to have much time for this during the summer. If you're not in much of a hurry to include this in PHP, then I'd be happy to review and discuss it with you later. On a related note, I think that your PHP-PasswordLib has too much stuff in it: https://github.com/ircmaxell/PHP-PasswordLib What immediately caught my attention is this: "Secure Random Number/String Generation [...] The mixing function is also dependent upon the strength required. For non-cryptographic numbers, a simple XOR mixing function is used (for speed). As strength requirements increase, it will use a SHA512 based mixing function, then a DES based mixing function and finally an AES-128 based mixing function at "High" strength." I see no reason to support these four modes instead of just one, e.g. based on SHA-512. Just how is DES or AES any better for this purpose? Perhaps leave the mode based on SHA-512 only. (I haven't looked at the code yet, though.) I do realize that this is a separate project, but I am concerned that you might similarly provide too much stuff via your new API right away. The API should be generic enough that future stuff would be likely to fit it well, but there shouldn't be unneeded stuff available via it now just to provide more examples. Thanks, Alexander
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.