diff options
| author | Remi Collet <remi@php.net> | 2019-07-15 14:10:38 +0200 |
|---|---|---|
| committer | Remi Collet <remi@php.net> | 2019-07-15 14:10:38 +0200 |
| commit | eab0079c902a9a52773c6bb63b57555dee45b3ab (patch) | |
| tree | b03951a26d7327b9a56fe7dd25195b7c59dd9681 | |
| parent | 768ad70f70a1bebed38e2b06a7515e3c61482f75 (diff) | |
| download | php-git-eab0079c902a9a52773c6bb63b57555dee45b3ab.tar.gz | |
Fix #78269 password_hash uses weak options for argon2
| -rw-r--r-- | NEWS | 1 | ||||
| -rw-r--r-- | ext/standard/php_password.h | 6 | ||||
| -rw-r--r-- | ext/standard/tests/password/password_needs_rehash_argon2.phpt | 6 |
3 files changed, 6 insertions, 7 deletions
@@ -45,6 +45,7 @@ PHP NEWS - Standard: . Fixed bug #78241 (touch() does not handle dates after 2038 in PHP 64-bit). (cmb) + . Fixed bug #78269 (password_hash uses weak options for argon2). (Remi) 27 Jun 2019, PHP 7.2.20 diff --git a/ext/standard/php_password.h b/ext/standard/php_password.h index c7dca73839..ada0c802f2 100644 --- a/ext/standard/php_password.h +++ b/ext/standard/php_password.h @@ -33,9 +33,9 @@ PHP_MINIT_FUNCTION(password); #define PHP_PASSWORD_BCRYPT_COST 10 #if HAVE_ARGON2LIB -#define PHP_PASSWORD_ARGON2_MEMORY_COST 1<<10 -#define PHP_PASSWORD_ARGON2_TIME_COST 2 -#define PHP_PASSWORD_ARGON2_THREADS 2 +#define PHP_PASSWORD_ARGON2_MEMORY_COST (64 << 10) +#define PHP_PASSWORD_ARGON2_TIME_COST 4 +#define PHP_PASSWORD_ARGON2_THREADS 1 #endif typedef enum { diff --git a/ext/standard/tests/password/password_needs_rehash_argon2.phpt b/ext/standard/tests/password/password_needs_rehash_argon2.phpt index 0b5fede1e3..129bed5989 100644 --- a/ext/standard/tests/password/password_needs_rehash_argon2.phpt +++ b/ext/standard/tests/password/password_needs_rehash_argon2.phpt @@ -9,14 +9,12 @@ if (!defined('PASSWORD_ARGON2I')) die('skip password_needs_rehash not built with $hash = password_hash('test', PASSWORD_ARGON2I); var_dump(password_needs_rehash($hash, PASSWORD_ARGON2I)); -var_dump(password_needs_rehash($hash, PASSWORD_ARGON2I, ['memory_cost' => 1<<17])); -var_dump(password_needs_rehash($hash, PASSWORD_ARGON2I, ['time_cost' => 4])); -var_dump(password_needs_rehash($hash, PASSWORD_ARGON2I, ['threads' => 4])); +var_dump(password_needs_rehash($hash, PASSWORD_ARGON2I, ['memory_cost' => PASSWORD_ARGON2_DEFAULT_MEMORY_COST * 2])); +var_dump(password_needs_rehash($hash, PASSWORD_ARGON2I, ['time_cost' => PASSWORD_ARGON2_DEFAULT_TIME_COST +1])); echo "OK!"; ?> --EXPECT-- bool(false) bool(true) bool(true) -bool(true) OK! |