Re: [DRAFT RFC] Adding Simplified Password Hashing API

Chris, > Can you update the RFC (aka future documentation) and make this obvious > to an end user? I just made an update (in the behavior sections). Let me know if additional clarification is needed. > I think PASSWORD_BCRYPT should be an ordinal value, which the new > library maps to "2y" when bcrypt is called. That would be fine. The initial goal for mapping the prefix to the constant was to provide the ability to map hash prefixes to the argument. That way, we could add user-supplied algorithms and base everything off the prefix with no additional mapping needed. But now that's off the table, I think switching back to an ordinal would be fine (and would pretty up the code a bit)... > The API of password_make_salt() seems restrictive.  What if other > options are needed in future? Can you give any examples of what options would be needed in the future, or how you would like to see the API? Thanks for the feedback! Anthony