Bug #78516 [Ver->Csd]: password_hash(): Memory cost is outside of allowed memory range

Edit report at https://bugs.php.net/bug.php?id=78516&edit=1 ID: 78516 Updated by: cmb@php.net Reported by: patrick at heppler dot net Summary: password_hash(): Memory cost is outside of allowed memory range -Status: Verified +Status: Closed Type: Bug Package: hash related Operating System: CentOS 7.6 PHP Version: 7.4.0RC1 Assigned To: cmb Block user comment: N Private report: N New Comment: Automatic comment on behalf of cmbecker69@gmx.de Revision: http://git.php.net/?p=php-src.git;a=commit;h=145ffd93fcac5fc04ae50464a34bc5e14fccc203 Log: Fix #78516: password_hash(): Memory cost is not in allowed range Previous Comments: ------------------------------------------------------------------------ [2019-09-10 09:39:57] cmb@php.net The following pull request has been associated: Patch Name: Fix #78516: password_hash(): Memory cost is outside of allowed memory… On GitHub: https://github.com/php/php-src/pull/4695 Patch: https://github.com/php/php-src/pull/4695.patch ------------------------------------------------------------------------ [2019-09-09 17:15:15] cmb@php.net > […], while on PHP 7.4 it get's 8KB, right? Just seen that it's always 8MB[1]; only the check[2] doesn't yet cater to that. [1] <https://github.com/php/php-src/blob/php-7.4.0RC1/ext/sodium/sodium_pwhash.c#L76> [2] <https://github.com/php/php-src/blob/php-7.4.0RC1/ext/sodium/sodium_pwhash.c#L57> ------------------------------------------------------------------------ [2019-09-09 17:04:40] patrick at heppler dot net Ok, now it's clear. In PHP 7.2 and 7.3 memory_cost=8192 will end up in 8MB, while on PHP 7.4 it get's 8KB, right? ------------------------------------------------------------------------ [2019-09-09 17:02:59] cmb@php.net Actually confirmed. In my opinion, the options should have the same meaning, regardless of whether libargon or libsodium is used. ------------------------------------------------------------------------ [2019-09-09 16:48:16] cmb@php.net See <https://bugs.php.net/bug.php?id=78269#1562751980>. OP uses libsodium. ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=78516 -- Edit this bug report at https://bugs.php.net/bug.php?id=78516&edit=1