[php-src] PR #24281: Make password salt generation algo-agnostic and isolate bcrypt-specific logic
| From: | narfbg | Date: | Mon, 12 Oct 2026 15:33:08 +0000 |
| Subject: | [php-src] PR #24281: Make password salt generation algo-agnostic and isolate bcrypt-specific logic | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-39364@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/24281
Author: narfbg
- Fixes a bug where the libargon2 implementation uses less entropy than intended (still safe, but
below baseline).
- Aligned bcrypt salt encoding more closely to bcrypt's variant. Previously, it relied on
php_crypt() doing the error correction. This is still not entirely following bcrypt as designed, but
that's for another time.
- Stricter bcrypt sanity checks, and fewer zend_string allocations.