Bug #78516 [Nab]: password_hash(): Memory cost is outside of allowed memory range

Edit report at https://bugs.php.net/bug.php?id=78516&edit=1 ID: 78516 Updated by: cmb@php.net Reported by: patrick at heppler dot net Summary: password_hash(): Memory cost is outside of allowed memory range Status: Not a bug Type: Bug Package: hash related Operating System: CentOS 7.6 PHP Version: 7.4.0RC1 Block user comment: N Private report: N New Comment: See <https://bugs.php.net/bug.php?id=78269#1562751980>. OP uses libsodium. Previous Comments: ------------------------------------------------------------------------ [2019-09-09 16:39:03] patrick at heppler dot net Yes, exactly! password_hash('secret',PASSWORD_ARGON2ID,['memory_cost'=>8191]); Results in: password_hash(): Memory cost is outside of allowed memory range While this works password_hash('secret',PASSWORD_ARGON2ID,['memory_cost'=>8192]); PHP is php74-php-cli-7.4.0~rc1-18.el7.remi.x86_64 on CentOS 7.6 ------------------------------------------------------------------------ [2019-09-09 16:33:12] requinix@php.net First a correction: memory_cost is KB, not bytes, so memory_cost=8191 ~ 8MB. So the minimum is memory_cost=8. To be absolutely clear here, you're saying that this *exact* code password_hash('secret',PASSWORD_ARGON2ID,['memory_cost'=>8191]); fails with that error (in PHP 7.4) while password_hash('secret',PASSWORD_ARGON2ID,['memory_cost'=>8192]); does not? ------------------------------------------------------------------------ [2019-09-09 16:11:45] patrick at heppler dot net Okay, but with PHP 7.2.22 and PHP 7.3.9 I can use password_hash('secret',PASSWORD_ARGON2I,['memory_cost'=>1024]) password_hash('secret',PASSWORD_ARGON2ID,['memory_cost'=>1024]) and it works. So I thought it's a bug. ------------------------------------------------------------------------ [2019-09-09 10:23:30] requinix@php.net Argon2 requires a minimum of 8KB. ------------------------------------------------------------------------ [2019-09-09 10:17:58] patrick at heppler dot net Description: ------------ Using password_hash with PASSWORD_ARGON2I or PASSWORD_ARGON2ID and a memory_cost of less than 8192 throws: password_hash(): Memory cost is outside of allowed memory range Test script: --------------- password_hash('secret',PASSWORD_ARGON2ID,['memory_cost'=>8191]) password_hash('secret',PASSWORD_ARGON2I,['memory_cost'=>8191]) Expected result: ---------------- A hashed password Actual result: -------------- PHP Warning: password_hash(): Memory cost is outside of allowed memory range ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=78516&edit=1