note 125950 added to function.sodium-crypto-pwhash-str

If you want to ensure that the hashes you generate with sodium_crypto_pwhash_str are compatible with those generated by password_hash, you need to keep an eye on that memory setting. According to the docs, the password_hash memory_cost param is given in "kibibytes", whereas sodium_crypto_pwhash_str uses bytes. I did some experiments to see what the difference is and ran into this: echo password_hash('password', PASSWORD_ARGON2ID, [ 'memory_cost' => 15000, 'time_cost' => 26, 'threads' => 1, ]; echo sodium_crypto_pwhash_str( 'password', 26, 15000000); These result in: $argon2id$v=19$m=15000,t=26,p=1$VG5MSkhUdEdFaGwyVG5sWA$laRHogIVAnC4ggLI8RdCDWlITTdicrdq0tK6SHGf4CI $argon2id$v=19$m=14648,t=26,p=1$ClQ37/z9u7K6V1C2bkD4QA$51m8KhQQ9gujFSF+JyQR9d5QesayJiKsFmDU4HnGBHg Notice that the "m=" numbers are different, and also different from what we asked for. It's down to the "kibibytes" unit. If we multiply the 15000 we used for password_hash by 1,024 instead of 1,000, we get 15,360,000, and using that number gives us the expected hash params: echo sodium_crypto_pwhash_str( 'password', 26, 15360000); $argon2id$v=19$m=15000,t=26,p=1$Qz3pWktOvT6X/LvdAk0bgQ$KosSFPfHUtWg+ppyRs3Op5/zIV6F6iy2Q7Gom8wP29c This should be compatible with password_hash. Incidentally the numbers I'm using for the Argon2id hash params are taken from the OWASP password guide, which recommend values different from PHP's default: https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#argon2id ---- Server IP: 45.112.84.4 Probable Submitter: 45.112.85.242 (proxied: 2a01:e0a:4c6:2f80:a0ab:a7e8:bae5:8764) ---- Manual Page -- http://php.net/manual/en/function.sodium-crypto-pwhash-str.php Edit -- https://master.php.net/note/edit/125950 Del: integrated -- https://master.php.net/note/delete/125950/integrated Del: useless -- https://master.php.net/note/delete/125950/useless Del: bad code -- https://master.php.net/note/delete/125950/bad+code Del: spam -- https://master.php.net/note/delete/125950/spam Del: non-english -- https://master.php.net/note/delete/125950/non-english Del: in docs -- https://master.php.net/note/delete/125950/in+docs Del: other reasons-- https://master.php.net/note/delete/125950 Reject -- https://master.php.net/note/reject/125950 Search -- https://master.php.net/manage/user-notes.php