Bug #78516 [PATCH]: password_hash(): Memory cost is outside of allowed memory range

Edit report at https://bugs.php.net/bug.php?id=78516&edit=1 ID: 78516 Patch added by: cmb@php.net Reported by: patrick at heppler dot net Summary: password_hash(): Memory cost is outside of allowed memory range Status: Verified Type: Bug Package: hash related Operating System: CentOS 7.6 PHP Version: 7.4.0RC1 Assigned To: cmb Block user comment: N Private report: N New Comment: The following pull request has been associated: Patch Name: Fix #78516: password_hash(): Memory cost is outside of allowed memory… On GitHub: https://github.com/php/php-src/pull/4695 Patch: https://github.com/php/php-src/pull/4695.patch Previous Comments: ------------------------------------------------------------------------ [2019-09-09 17:15:15] cmb@php.net > […], while on PHP 7.4 it get's 8KB, right? Just seen that it's always 8MB[1]; only the check[2] doesn't yet cater to that. [1] <https://github.com/php/php-src/blob/php-7.4.0RC1/ext/sodium/sodium_pwhash.c#L76> [2] <https://github.com/php/php-src/blob/php-7.4.0RC1/ext/sodium/sodium_pwhash.c#L57> ------------------------------------------------------------------------ [2019-09-09 17:04:40] patrick at heppler dot net Ok, now it's clear. In PHP 7.2 and 7.3 memory_cost=8192 will end up in 8MB, while on PHP 7.4 it get's 8KB, right? ------------------------------------------------------------------------ [2019-09-09 17:02:59] cmb@php.net Actually confirmed. In my opinion, the options should have the same meaning, regardless of whether libargon or libsodium is used. ------------------------------------------------------------------------ [2019-09-09 16:48:16] cmb@php.net See <https://bugs.php.net/bug.php?id=78269#1562751980>. OP uses libsodium. ------------------------------------------------------------------------ [2019-09-09 16:39:03] patrick at heppler dot net Yes, exactly! password_hash('secret',PASSWORD_ARGON2ID,['memory_cost'=>8191]); Results in: password_hash(): Memory cost is outside of allowed memory range While this works password_hash('secret',PASSWORD_ARGON2ID,['memory_cost'=>8192]); PHP is php74-php-cli-7.4.0~rc1-18.el7.remi.x86_64 on CentOS 7.6 ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=78516 -- Edit this bug report at https://bugs.php.net/bug.php?id=78516&edit=1