Password_hash salt generation refactor
| From: | Anthony Ferrara | Date: | Sun, 18 Oct 2015 22:59:59 +0000 |
| Subject: | Password_hash salt generation refactor | ||
| Groups: | php.internals | ||
| Request: | Send a blank email to internals+get-88862@lists.php.net to get a copy of this message | ||
All,
With PHP 7 comes random_bytes and random_int. This duplicates some of
the logic internally that password_hash uses to generate its salt.
I would like to refactor this to unify generation. I've opened a PR
against master: https://github.com/php/php-src/pull/1585
I don't feel comfortable pulling against 7 this far into RC status.
Perhaps wait until after it goes gold? Or should this target 7.1? It's
not a big deal in either direction. Though it does add a side-effect,
where if it can't gather enough entropy it will throw an exception and
return failure (where prior it would simply make a "best effort".
Thoughts?
Anthony