note 109781 deleted from function.hash-pbkdf2 by aharvey
| From: | aharvey@php.net | Date: | Tue, 21 Aug 2012 02:25:56 +0000 |
| Subject: | note 109781 deleted from function.hash-pbkdf2 by aharvey | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-190149@lists.php.net to get a copy of this message | ||
Note Submitter: Nuno Loureiro
----
I don't understand the purpose of the following warning on the man page:
"Caution: The PBKDF2 method can be used for hashing passwords for storage (it is NIST approved
for that use). However, it should be noted that CRYPT_BLOWFISH is better suited for password storage
and should be used instead via crypt()."
As you state PBKDF2 is NIST approved for that usage, BLOWFISH is not. From what I've read, that
CRYPT_BLOWFISH is not the same as bcrypt but even if it was, warning someone to use it instead of
PBKDF2 is wrong. I would accept it as a security professional's opinion in a comment of this
page, not stated like that in a man page on behalf of the php developers community.