Re: [Discussion] Changing PASSWORD_DEFAULT to Argon2
| From: | Anton Smirnov | Date: | Sat, 19 Sep 2026 19:58:04 +0000 |
| Subject: | Re: [Discussion] Changing PASSWORD_DEFAULT to Argon2 | ||
| References: | 1 2 3 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-132556@lists.php.net to get a copy of this message | ||
On 19/09/2026 12:26, Andrey Andreev wrote:
Hi Anton, On Sat, Sep 19, 2026 at 5:15 AM Anton Smirnov <sandfox@sandfox.me <mailto:sandfox@sandfox.me>> wrote:My point is mostly about this part:Did anything change since the last time?https://externals.io/message/120993#120996 <https://externals.io/ message/120993#120996>Yes, that thread is from September 2023, more than a year before PHP 8.4's release bringing in the --with-openssl-argon2 flag. libargon2 and libsodium can't be relied upon to exist on most systems, but openssl is a very different beast. There already exists a year-old proposal to enable --with-openssl-argon2 by default (https://github.com/php/php-src/pull/19360 <https:// github.com/php/php-src/pull/19360>). It would be fair to point out that I am thinking ahead of it, this is exploring potential and there are plenty of subsequent problems to debate after. But whether the openssl dependency is acceptable is the most critical one. Cheers, Andrey.
Argon2 for settings that are reasonable for interactive authentication is worse than BCryptLike, if there were any successful attacks on bcrypt that negate that part