Re: [VOTE] Change crypt() behavior w/o salt

From: Date: Wed, 23 Oct 2013 00:35:02 +0000
Subject: Re: [VOTE] Change crypt() behavior w/o salt
References: 1 2 3 4 5 6 7 8  Groups: php.internals 
Request: Send a blank email to internals+get-69791@lists.php.net to get a copy of this message
On 23/10/2013 01:26, Yasuo Ohgaki wrote:
On Wed, Oct 23, 2013 at 2:11 AM, Adam Harvey <aharvey@php.net <mailto:aharvey@php.net>> wrote: 
    "Generating an insecure weak hash as no salt was given: please ensure
    the salt parameter is specified and uses a strong hash type in order
    to generate a cryptographically secure hash"
I guess this would be one of the longest error message, but it does not matter. If there isn't better message, I'll commit with this message in a few days.
How about "No salt parameter was specified. You must use a randomly generated salt and a strong hash function to produce a secure hash." It doesn't emphasise the "strong" and "weak" as much, but I feel it gets the message acrosss well nonetheless. -- Andrea Faulds http://ajf.me/

« previous php.internals (#69791) next »