archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-15 21:48:51 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Relax argon2 mem_cost down to 64k, bump time_cost to 4

Browse source
This commit is contained in:
Sara Golemon 2019-07-09 11:18:13 -04:00
parent aa0e29a668
commit f65956e4fb
No known key found for this signature in database
GPG key ID: DBDB397470D12172
5 changed files with 28 additions and 35 deletions
Download patch file Download diff file Expand all files Collapse all files

5
ext/sodium/sodium_pwhash.c
View file

@ -29,7 +29,6 @@
#if SODIUM_LIBRARY_VERSION_MAJOR > 9 || (SODIUM_LIBRARY_VERSION_MAJOR == 9 && SODIUM_LIBRARY_VERSION_MINOR >= 6)
/**
* OPSLIMIT and MEMLIMIT are taken from libsodium's MODERATE values.
* MEMLIMIT is normalized to KB even though sodium uses Bytes in order to
* present a consistent user-facing API.
*
@ -37,8 +36,8 @@
*
* When updating these values, synchronize ext/standard/php_password.h values.
*/
#define PHP_SODIUM_PWHASH_MEMLIMIT (256 << 10)
#define PHP_SODIUM_PWHASH_OPSLIMIT 3
#define PHP_SODIUM_PWHASH_MEMLIMIT (64 << 10)
#define PHP_SODIUM_PWHASH_OPSLIMIT 4
#define PHP_SODIUM_PWHASH_THREADS 1
static zend_string *php_sodium_argon2_hash(const zend_string *password, zend_array *options, int alg) {

18
ext/sodium/tests/php_password_hash_argon2i.phpt
View file

@ -36,38 +36,38 @@ foreach([1, 2, 4] as $mem) {
--EXPECTF--
Argon2 provider: string(%d) "%s"
Using password: string(44) "%s"
Hash: string(97) "$argon2i$v=19$m=262144,t=3,p=1$%s$%s"
Hash: string(96) "$argon2i$v=19$m=65536,t=4,p=1$%s$%s"
bool(true)
bool(false)
Using password: string(44) "%s"
Hash: string(97) "$argon2i$v=19$m=262144,t=6,p=1$%s$%s"
Hash: string(96) "$argon2i$v=19$m=65536,t=8,p=1$%s$%s"
bool(true)
bool(false)
Using password: string(44) "%s"
Hash: string(98) "$argon2i$v=19$m=262144,t=12,p=1$%s$%s"
Hash: string(97) "$argon2i$v=19$m=65536,t=16,p=1$%s$%s"
bool(true)
bool(false)
Using password: string(44) "%s"
Hash: string(97) "$argon2i$v=19$m=524288,t=3,p=1$%s$%s"
Hash: string(97) "$argon2i$v=19$m=131072,t=4,p=1$%s$%s"
bool(true)
bool(false)
Using password: string(44) "%s"
Hash: string(97) "$argon2i$v=19$m=524288,t=6,p=1$%s$%s"
Hash: string(97) "$argon2i$v=19$m=131072,t=8,p=1$%s$%s"
bool(true)
bool(false)
Using password: string(44) "%s"
Hash: string(98) "$argon2i$v=19$m=524288,t=12,p=1$%s$%s"
Hash: string(98) "$argon2i$v=19$m=131072,t=16,p=1$%s$%s"
bool(true)
bool(false)
Using password: string(44) "%s"
Hash: string(98) "$argon2i$v=19$m=1048576,t=3,p=1$%s$%s"
Hash: string(97) "$argon2i$v=19$m=262144,t=4,p=1$%s$%s"
bool(true)
bool(false)
Using password: string(44) "%s"
Hash: string(98) "$argon2i$v=19$m=1048576,t=6,p=1$%s$%s"
Hash: string(97) "$argon2i$v=19$m=262144,t=8,p=1$%s$%s"
bool(true)
bool(false)
Using password: string(44) "%s"
Hash: string(99) "$argon2i$v=19$m=1048576,t=12,p=1$%s$%s"
Hash: string(98) "$argon2i$v=19$m=262144,t=16,p=1$%s$%s"
bool(true)
bool(false)

19
ext/sodium/tests/php_password_hash_argon2id.phpt
View file

@ -36,38 +36,39 @@ foreach([1, 2, 4] as $mem) {
--EXPECTF--
Argon2 provider: string(%d) "%s"
Using password: string(44) "%s"
Hash: string(98) "$argon2id$v=19$m=262144,t=3,p=1$%s$%s"
Hash: string(97) "$argon2id$v=19$m=65536,t=4,p=1$%s$%s"
bool(true)
bool(false)
Using password: string(44) "%s"
Hash: string(98) "$argon2id$v=19$m=262144,t=6,p=1$%s$%s"
Hash: string(97) "$argon2id$v=19$m=65536,t=8,p=1$%s$%s"
bool(true)
bool(false)
Using password: string(44) "%s"
Hash: string(99) "$argon2id$v=19$m=262144,t=12,p=1$%s$%s"
Hash: string(98) "$argon2id$v=19$m=65536,t=16,p=1$%s$%s"
bool(true)
bool(false)
Using password: string(44) "%s"
Hash: string(98) "$argon2id$v=19$m=524288,t=3,p=1$%s$%s"
Hash: string(98) "$argon2id$v=19$m=131072,t=4,p=1$%s$%s"
bool(true)
bool(false)
Using password: string(44) "%s"
Hash: string(98) "$argon2id$v=19$m=524288,t=6,p=1$%s$%s"
Hash: string(98) "$argon2id$v=19$m=131072,t=8,p=1$%s$%s"
bool(true)
bool(false)
Using password: string(44) "%s"
Hash: string(99) "$argon2id$v=19$m=524288,t=12,p=1$%s$%s"
Hash: string(99) "$argon2id$v=19$m=131072,t=16,p=1$%s$%s"
bool(true)
bool(false)
Using password: string(44) "%s"
Hash: string(99) "$argon2id$v=19$m=1048576,t=3,p=1$%s$%s"
Hash: string(98) "$argon2id$v=19$m=262144,t=4,p=1$%s$%s"
bool(true)
bool(false)
Using password: string(44) "%s"
Hash: string(99) "$argon2id$v=19$m=1048576,t=6,p=1$%s$%s"
Hash: string(98) "$argon2id$v=19$m=262144,t=8,p=1$%s$%s"
bool(true)
bool(false)
Using password: string(44) "%s"
Hash: string(100) "$argon2id$v=19$m=1048576,t=12,p=1$%s$%s"
Hash: string(99) "$argon2id$v=19$m=262144,t=16,p=1$%s$%s"
bool(true)
bool(false)

7
ext/standard/php_password.h
View file

@ -34,14 +34,11 @@ PHP_MSHUTDOWN_FUNCTION(password);
#if HAVE_ARGON2LIB
/**
* OPSLIMIT and MEMLIMIT are taken from libsodium's MODERATE values.
* Threads are fixed at 1 by libsodium.
*
* When updating these values, synchronize ext/sodium/sodium_pwhash.c values.
* Note that libargon expresses memlimit in KB, while libsoidum uses bytes.
*/
#define PHP_PASSWORD_ARGON2_MEMORY_COST (256 << 10)
#define PHP_PASSWORD_ARGON2_TIME_COST 3
#define PHP_PASSWORD_ARGON2_MEMORY_COST (64 << 10)
#define PHP_PASSWORD_ARGON2_TIME_COST 4
#define PHP_PASSWORD_ARGON2_THREADS 1
#endif

14
ext/standard/tests/password/password_needs_rehash_argon2.phpt
View file

@ -10,24 +10,20 @@ if (!defined('PASSWORD_ARGON2ID')) die('skip password_hash not built with Argon2
$hash = password_hash('test', PASSWORD_ARGON2I);
var_dump(password_needs_rehash($hash, PASSWORD_ARGON2I));
var_dump(password_needs_rehash($hash, PASSWORD_ARGON2I, ['memory_cost' => 1<<17]));
var_dump(password_needs_rehash($hash, PASSWORD_ARGON2I, ['time_cost' => 4]));
var_dump(password_needs_rehash($hash, PASSWORD_ARGON2I, ['threads' => 4]));
var_dump(password_needs_rehash($hash, PASSWORD_ARGON2I, ['memory_cost' => PASSWORD_ARGON2_DEFAULT_MEMORY_COST * 2]));
var_dump(password_needs_rehash($hash, PASSWORD_ARGON2I, ['time_cost' => PASSWORD_ARGON2_DEFAULT_TIME_COST + 1]));
$hash = password_hash('test', PASSWORD_ARGON2ID);
var_dump(password_needs_rehash($hash, PASSWORD_ARGON2ID));
var_dump(password_needs_rehash($hash, PASSWORD_ARGON2ID, ['memory_cost' => 1<<17]));
var_dump(password_needs_rehash($hash, PASSWORD_ARGON2ID, ['time_cost' => 4]));
var_dump(password_needs_rehash($hash, PASSWORD_ARGON2ID, ['threads' => 4]));
var_dump(password_needs_rehash($hash, PASSWORD_ARGON2ID, ['memory_cost' => PASSWORD_ARGON2_DEFAULT_MEMORY_COST * 2]));
var_dump(password_needs_rehash($hash, PASSWORD_ARGON2ID, ['time_cost' => PASSWORD_ARGON2_DEFAULT_TIME_COST + 1]));
echo "OK!";
?>
--EXPECT--
bool(false)
bool(true)
bool(true)
bool(true)
bool(false)
bool(true)
bool(true)
bool(true)
OK!