Everything

php

[RFC][VOTE]: Argon2 Password Hash (Reopened)

php.internals

Charles R. Portwood II

10 years ago

Hello,

The RFC for introducing Argon2 as an alternative hashing algorithm for the
password_* functions is now re-open. The RFC is available at
https://wiki.php.net/rfc/argon2_password_hash
.

Voting is open for 2 week, and will close on September 7th. A 50%+1
majority required to pass. If you previously voted you will need to vote
again, as the original vote was closed shortly after opening due to an
issue with the original RFC language.

Thanks!
*Charles R. Portwood II*

Derick Rethans

10 years ago

On Wed, 24 Aug 2016, Charles R. Portwood II wrote:

> The RFC for introducing Argon2 as an alternative hashing algorithm for
> the password_* functions is now re-open. The RFC is available at
> https://wiki.php.net/rfc/argon2_password_hash .
>
> Voting is open for 2 week, and will close on September 7th. A 50%+1
> majority required to pass. If you previously voted you will need to
> vote again, as the original vote was closed shortly after opening due
> to an issue with the original RFC language.

I'd be happy to have this, but what is the point of requiring a
./configure flag[1] to enable this?

cheers,
Derick


[1] https://wiki.php.net/rfc/argon2_password_hash#configure_flag

--
https://derickrethans.nl | https://xdebug.org | https://dram.io
Like Xdebug? Consider a donation: https://xdebug.org/donate.php
twitter: @derickr and @xdebug

Derick Rethans

10 years ago

On Thu, 25 Aug 2016, Derick Rethans wrote:

> On Wed, 24 Aug 2016, Charles R. Portwood II wrote:
>
> > The RFC for introducing Argon2 as an alternative hashing algorithm for
> > the password_* functions is now re-open. The RFC is available at
> > https://wiki.php.net/rfc/argon2_password_hash .
> >
> > Voting is open for 2 week, and will close on September 7th. A 50%+1
> > majority required to pass. If you previously voted you will need to
> > vote again, as the original vote was closed shortly after opening due
> > to an issue with the original RFC language.
>
> I'd be happy to have this, but what is the point of requiring a
> ./configure flag[1] to enable this?

OK - it requires a library. Ignore.

cheers,
Derick

Charles R. Portwood II

9 years ago

On Wed, Aug 24, 2016 at 10:49 AM, Charles R. Portwood II wrote:

> Hello,
>
> The RFC for introducing Argon2 as an alternative hashing algorithm for the
> password_* functions is now re-open. The RFC is available at
> https://wiki.php.net/rfc/argon2_password_hash
> .
>
> Voting is open for 2 week, and will close on September 7th. A 50%+1
> majority required to pass. If you previously voted you will need to vote
> again, as the original vote was closed shortly after opening due to an
> issue with the original RFC language.
>
> Thanks!
> *Charles R. Portwood II*
>

Hello,

This is a reminder that today is the last day to vote for this RFC. If you
have not already voted, please do so today.

Thanks,
*Charles R. Portwood II*

Charles R. Portwood II

9 years ago

On Wed, Aug 24, 2016 at 10:49 AM, Charles R. Portwood II wrote:

> Hello,
>
> The RFC for introducing Argon2 as an alternative hashing algorithm for the
> password_* functions is now re-open. The RFC is available at
> https://wiki.php.net/rfc/argon2_password_hash
>
>
>
> .
>
> Voting is open for 2 week, and will close on September 7th. A 50%+1
> majority required to pass. If you previously voted you will need to vote
> again, as the original vote was closed shortly after opening due to an
> issue with the original RFC language.
>
> Thanks!
> *Charles R. Portwood II*
>

Hello,

Thanks to everyone who voted and contributed to the discussion. This RFC is
now closed, and was accepted 12-0 for 7.2. Would someone with VCS access
please merge this into master (7.2)?

Separately, what is the process for updating the manual since 7.2 is still
a ways off?

Thanks,
*Charles R. Portwood II*

Christoph Becker

9 years ago

On 08.09.2016 at 16:26, Charles R. Portwood II wrote:

> On Wed, Aug 24, 2016 at 10:49 AM, Charles R. Portwood II wrote:
>
>> The RFC for introducing Argon2 as an alternative hashing algorithm for the
>> password_* functions is now re-open. The RFC is available at
>> https://wiki.php.net/rfc/argon2_password_hash
>>
>> Voting is open for 2 week, and will close on September 7th. A 50%+1
>> majority required to pass. If you previously voted you will need to vote
>> again, as the original vote was closed shortly after opening due to an
>> issue with the original RFC language.
>
> Thanks to everyone who voted and contributed to the discussion. This RFC is
> now closed, and was accepted 12-0 for 7.2. Would someone with VCS access
> please merge this into master (7.2)?

Thanks for the RFC and the PR.  I've just merged it (commit 1305fdaa).

> Separately, what is the process for updating the manual since 7.2 is still
> a ways off?

Probably the first step should be to add some respective notes to
php-src/UPRADING.  Do you want to make a PR or provide a patch by some
other means?

That would already be sufficient, as the doc team is supposed to
integrate the UPGRADING information into the manual proper and the
respective migration guide.

Of course, it's also possible to update the manual now, making sure that
there are notes about the availability (maybe as changelog entries).

--
Christoph M. Becker

Charles R. Portwood II

9 years ago

On Thu, Sep 8, 2016 at 10:09 AM, Christoph M. Becker <cmbecker69@gmx.de>
wrote:

> On 08.09.2016 at 16:26, Charles R. Portwood II wrote:
>
> > On Wed, Aug 24, 2016 at 10:49 AM, Charles R. Portwood II wrote:
> >
> >> The RFC for introducing Argon2 as an alternative hashing algorithm for
> the
> >> password_* functions is now re-open. The RFC is available at
> >> https://wiki.php.net/rfc/argon2_password_hash
> >>
> >> Voting is open for 2 week, and will close on September 7th. A 50%+1
> >> majority required to pass. If you previously voted you will need to vote
> >> again, as the original vote was closed shortly after opening due to an
> >> issue with the original RFC language.
> >
> > Thanks to everyone who voted and contributed to the discussion. This RFC
> is
> > now closed, and was accepted 12-0 for 7.2. Would someone with VCS access
> > please merge this into master (7.2)?
>
> Thanks for the RFC and the PR.  I've just merged it (commit 1305fdaa).
>
> > Separately, what is the process for updating the manual since 7.2 is
> still
> > a ways off?
>
> Probably the first step should be to add some respective notes to
> php-src/UPRADING.  Do you want to make a PR or provide a patch by some
> other means?
>
> That would already be sufficient, as the doc team is supposed to
> integrate the UPGRADING information into the manual proper and the
> respective migration guide.
>
> Of course, it's also possible to update the manual now, making sure that
> there are notes about the availability (maybe as changelog entries).
>
> --
> Christoph M. Becker
>

Christoph,

I've provided a patch on the Github pull request for the UPGRADING notes..
https://github.com/php/php-src/pull/1997#issuecomment-245678319