note 115041 added to function.crypt

If you're stuck with CRYPT_EXT_DES, then you'll want to pick a number of iterations: the 2nd-5th characters of the "salt". My experimentation suggests that the 5th character is the most significant. A '.' is a zero and 'Z' is the highest value. Using all dots will create an error: all passwords will be encrypted to the same value. Here are some encryption timings (in seconds) that I obtained, with five different iteration counts over the same salt, and the same password, on a quad core 2.66GHz Intel Xeon machine. _1111 time: 0.15666794776917 _J9.Z time: 1.8860530853271 _J9.. time: 0.00015401840209961 _...Z time: 1.9095730781555 _ZZZZ time: 1.9124970436096 _...A time: 0.61211705207825 I think a half a second is reasonable for an application, but for the back end authentication? I'm not so sure: there's a significant risk of overloading the back end if we're getting lots of authentication requests. ---- Server IP: 87.124.126.49 Probable Submitter: 139.184.30.135 (proxied: 139.184.135.189) ---- Manual Page -- http://php.net/manual/en/function.crypt.php Edit -- https://master.php.net/note/edit/115041 Del: integrated -- https://master.php.net/note/delete/115041/integrated Del: useless -- https://master.php.net/note/delete/115041/useless Del: bad code -- https://master.php.net/note/delete/115041/bad+code Del: spam -- https://master.php.net/note/delete/115041/spam Del: non-english -- https://master.php.net/note/delete/115041/non-english Del: in docs -- https://master.php.net/note/delete/115041/in+docs Del: other reasons-- https://master.php.net/note/delete/115041 Reject -- https://master.php.net/note/reject/115041 Search -- https://master.php.net/manage/user-notes.php