Re: [Discussion] Changing PASSWORD_DEFAULT to Argon2
| From: | Tim Düsterhus | Date: | Mon, 21 Sep 2026 17:11:39 +0000 |
| Subject: | Re: [Discussion] Changing PASSWORD_DEFAULT to Argon2 | ||
| References: | 1 2 3 4 5 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-132582@lists.php.net to get a copy of this message | ||
Hi
On 2026-09-20 15:46, Andrey Andreev wrote:
By 2023, we have slightly more clarity and comparable strenghts at just over 500ms: https://infosec.exchange/@epixoip/110912922574721750 (note that it looks somewhat scary because of the large memory cost, but time cost is always 1; very different from PHP's defaults)500ms is insanely long for interactive authentication. And the memory cost in that example benchmark is indeed scary when you consider that PHP ships with a default memory_limit of 128 MB (though it seems that the Argon2 hashing is not included in the memory_limit accounting). Best regards Tim Düsterhus