RE: [PHP-DEV] [PROPOSED] password_hash RFC - Implementing simplified password hashing functions
| From: | Jonathan Bond-Caron | Date: | Wed, 01 Aug 2012 19:09:35 +0000 |
| Subject: | RE: [PHP-DEV] [PROPOSED] password_hash RFC - Implementing simplified password hashing functions | ||
| References: | 1 2 3 4 5 6 7 8 9 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-61942@lists.php.net to get a copy of this message | ||
>
> Also, be aware that BCrypt only uses the first 72 characters of the
> password field. So if you use a hex encoded sha512 output, a good deal
> of entropy would be lost (almost half of it)...
>
Good to know, do most hash algorithms have limitations on the # of chars as
input?
That would explain why (password || key) into a hash function has
limitations.