Re: RFC: Increasing the default BCrypt cost
| From: | Tim Düsterhus | Date: | Tue, 12 Sep 2023 16:01:27 +0000 |
| Subject: | Re: RFC: Increasing the default BCrypt cost | ||
| References: | 1 2 3 4 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-121047@lists.php.net to get a copy of this message | ||
Hi
On 9/12/23 17:56, Hans Henrik Bergan wrote:
It appears your benchmarks are broken, because you're also measuring the startup cost of PHP itself. You should see an approximate doubling in time taken for each increase of the cost, but you have 122ms for 9 and 166ms for 10. A simple microtime(true) benchmark loop as used with my test script should be fine for ballpark estimates, as password_hash() is pretty heavy, dwarfing the measurement overhead. Best regards Tim Düsterhusweb hosters *love* their ancient hardwareNo kidding. dreamhost.com host over 1.5 million websites, presumably most are on their "Shared Unlimited" package, which runs on AMD Opteron 4122, a high-end server CPU from 2010. Some benchmarks there: