password_hash: don't fail on unsupported threads value#7099
password_hash: don't fail on unsupported threads value#7099remicollet wants to merge 2 commits intophp:PHP-7.4from
Conversation
As this is only about how hash is computed (in other implementation) and have no effect on result. This will improve code compatibility for the various implementations
|
Perhaps we can even drop this check Notice: on PHP 8 this is even a value error (which also have to be changed to notice, or drop) @sgolemon as you are the author of this implementation, please review. |
|
|
I'm not convinced we should drop this. Yes, it may not impact the result, but it may affect timing assumptions. The programmer should drop the option for a compatible implementation. |
|
About timing, for memory
|
|
The main issue, for now, is that the 'thread' usage raises an error, and no password is generated. Even if I don't really understand the perf point (both implementations have very different performance, and sodium is usually faster)... At least switching from E_WARNING + FAILURE to E_NOTICE seems needed (1st commit) P.S. I even think libargon2 should be deprecated when libsodium is used. |
As this is only about how hash is computed (in other implementation)
and have no effect on result.
This will improve code compatibility for the various implementations
Affects only distribution without argon2 library, and use sodium alternative implementation (which is faster)