Re: [RFC][Discussion] Add PASSWORD_BCRYPT_WRAP
| From: | Rowan Tommins [IMSoP] | Date: | Fri, 30 Oct 2026 10:22:37 +0000 |
| Subject: | Re: [RFC][Discussion] Add PASSWORD_BCRYPT_WRAP | ||
| References: | 1 2 3 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-132973@lists.php.net to get a copy of this message | ||
On 29 October 2026 23:29:14 GMT, Andrey Andreev <narf@devilix.net> wrote:
>I'm happy to correct vagueness, especially if you can point to the unclear
>piece of text. However, you are wrong on multiple counts here, and the
>answer as to why is in those exact last words in the quote: domain
>separation from naked hashes.
>Not only is there domain separation from naked hashes, there's domain
>separation between the Bcrypt and prehash salts (and even further than
>that).
Perhaps it would be useful to add to the RFC a non-technical explanation of how hash shucking works,
and how adding salt or pepper at the right stage protects against it.
I attempted to do that in the previous discussion here, based on my own limited understanding: https://externals.io/message/132784#132850
Regards,
Hi Andrey,
Thanks for the carefully designed RFC. It seems like a useful addition.
Rowan Tommins
[IMSoP]