Re: How about adding PHPass compatibility to the password hashing API
| From: | Nicolas Grekas | Date: | Thu, 13 Sep 2012 12:04:15 +0000 |
| Subject: | Re: How about adding PHPass compatibility to the password hashing API | ||
| References: | 1 2 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-62975@lists.php.net to get a copy of this message | ||
>
> With respect to adding those algorithms for generating hashes, I'm 100%
> dead set against it.
>
Ok, I understand and agree, generating hashes for weaker algos is not a
good idea.
The point I wanted to address was forward/backward compatibility with
existing password databases that use PHPass :
> The way password_verify is implemented, it can use any crypt(3) generated
> hash for verification.
>
So forward/backward backward compatibility is granted for CRYPT_EXT_DES,
well done.
Still, for md5 based hashes ($P$/$H$ prefixes), crypt() doesn't work.
What about handling these schemes only in password_verify() ?
I think that could help a lot on adoption rate for the new API, easing the
transition for current phpass users.
Nicolas