Req #75572 [NEW]: sodium_crypto_pwhash_str() allow opslimit of 1

From: phpdoc at mail dot my1 dot info Operating system: PHP version: 7.2.0RC6 Package: *Encryption and hash functions Bug Type: Feature/Change Request Bug description:sodium_crypto_pwhash_str() allow opslimit of 1 Description: ------------ when using an opslimit (which equals the time_cost parameter in password_hash with argon2i) of 1 a warning is thrown. this is a result of https://github.com/php/php-src/blob/master/ext/sodium/libsodium.c#L1905-L1908 and the fact that the constant SODIUM_CRYPTO_PWHASH_OPSLIMIT_INTERACTIVE is 2. considering the process on how the argon2 RFC goes for parameter choice, a time factor of 1 is certainly not impossible, in fact especially if the server has a lot of RAM, chances are that one would choose a time of 1 and go for the ram instead of lowering the RAM and choosing a 2 or higher for time if the situation allows. also as a side note the RFC even states that for argon2id (which is what sodium uses) that 1 pass maximizes the attack costs for the constant time of the defender. https://tools.ietf.org/html/draft-irtf-cfrg-argon2-03#section-9.3 Test script: --------------- <?php header("Content-Type: text/plain"); if(defined("SODIUM_CRYPTO_PWHASH_OPSLIMIT_INTERACTIVE")) { echo "NaCl Found. ".PHP_EOL; echo sodium_crypto_pwhash_str("test",1,1<<26).PHP_EOL; } else echo "no NaCl with pwhash".PHP_EOL; ?> Expected result: ---------------- NaCl Found. $argon2id$v=19$m=65536,t=1,p=1$h1v/Fexw43PMyi6W8NRRGA$QiqKXRL+csDoLqLT7p282LxPM3kfwc4UlGE5BUBD45w Actual result: -------------- NaCl Found. <br /> <b>Warning</b>: number of operations for the password hashing function is low in <b>C:\xampp\htdocs\a2.php</b> on line <b>5</b><br /> $argon2id$v=19$m=65536,t=1,p=1$h1v/Fexw43PMyi6W8NRRGA$QiqKXRL+csDoLqLT7p282LxPM3kfwc4UlGE5BUBD45w -- Edit bug report at https://bugs.php.net/bug.php?id=75572&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=75572&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=75572&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=75572&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=75572&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=75572&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=75572&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=75572&r=needscript Try newer version: https://bugs.php.net/fix.php?id=75572&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=75572&r=support Expected behavior: https://bugs.php.net/fix.php?id=75572&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=75572&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=75572&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=75572&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=75572&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=75572&r=dst IIS Stability: https://bugs.php.net/fix.php?id=75572&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=75572&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=75572&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=75572&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=75572&r=mysqlcfg