Bug #78516 [Com]: password_hash(): Memory cost is outside of allowed memory range

Edit report at https://bugs.php.net/bug.php?id=78516&edit=1 ID: 78516 Comment by: patrick at heppler dot net Reported by: patrick at heppler dot net Summary: password_hash(): Memory cost is outside of allowed memory range Status: Verified Type: Bug Package: hash related Operating System: CentOS 7.6 PHP Version: 7.4.0RC1 Block user comment: N Private report: N New Comment: Ok, now it's clear. In PHP 7.2 and 7.3 memory_cost=8192 will end up in 8MB, while on PHP 7.4 it get's 8KB, right? Previous Comments: ------------------------------------------------------------------------ [2019-09-09 17:02:59] cmb@php.net Actually confirmed. In my opinion, the options should have the same meaning, regardless of whether libargon or libsodium is used. ------------------------------------------------------------------------ [2019-09-09 16:48:16] cmb@php.net See <https://bugs.php.net/bug.php?id=78269#1562751980>. OP uses libsodium. ------------------------------------------------------------------------ [2019-09-09 16:39:03] patrick at heppler dot net Yes, exactly! password_hash('secret',PASSWORD_ARGON2ID,['memory_cost'=>8191]); Results in: password_hash(): Memory cost is outside of allowed memory range While this works password_hash('secret',PASSWORD_ARGON2ID,['memory_cost'=>8192]); PHP is php74-php-cli-7.4.0~rc1-18.el7.remi.x86_64 on CentOS 7.6 ------------------------------------------------------------------------ [2019-09-09 16:33:12] requinix@php.net First a correction: memory_cost is KB, not bytes, so memory_cost=8191 ~ 8MB. So the minimum is memory_cost=8. To be absolutely clear here, you're saying that this *exact* code password_hash('secret',PASSWORD_ARGON2ID,['memory_cost'=>8191]); fails with that error (in PHP 7.4) while password_hash('secret',PASSWORD_ARGON2ID,['memory_cost'=>8192]); does not? ------------------------------------------------------------------------ [2019-09-09 16:11:45] patrick at heppler dot net Okay, but with PHP 7.2.22 and PHP 7.3.9 I can use password_hash('secret',PASSWORD_ARGON2I,['memory_cost'=>1024]) password_hash('secret',PASSWORD_ARGON2ID,['memory_cost'=>1024]) and it works. So I thought it's a bug. ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=78516 -- Edit this bug report at https://bugs.php.net/bug.php?id=78516&edit=1