Re: [VOTE] Increasing the default BCrypt cost
| From: | Kamil Tekiela | Date: | Mon, 25 Sep 2023 19:55:17 +0000 |
| Subject: | Re: [VOTE] Increasing the default BCrypt cost | ||
| References: | 1 2 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-121142@lists.php.net to get a copy of this message | ||
Yes, BCrypt uses only the first 72 bytes for hash generation. You can
test it with:
var_dump(password_verify(str_repeat('a', 72).'sdfsdf',
password_hash(str_repeat('a', 80), PASSWORD_BCRYPT)));
But I would not consider this an issue. Users rarely create passwords
longer than 72 bytes. 72 bytes is still a very long password and not
easily guessable. What's more important is to have the minimum limit
check. But why bother checking the 72 maximum if the algorithm won't
complain about longer input? It doesn't impact security in any way.