Slashdot Mirror
PHP Now Supports Argon2 Next-Generation Password Hashing Algorithm (bleepingcomputer.com)
An anonymous reader quotes Bleeping Computer: PHP got a whole lot more secure this week with the release of the 7.2 branch, a version that improves and modernizes the language's support for cryptography and password hashing algorithms.
Of all changes, the most significant is, by far, the support for Argon2, a password hashing algorithm developed in the early 2010s. Back in 2015, Argon2 beat 23 other algorithms to win the Password Hashing Competition, and is now in the midst of becoming a universally recognized Internet standard at the Internet Engineering Task Force (IETF), the reward for winning the contest. The algorithm is currently considered to be superior to Bcrypt, today's most widely used password hashing function, in terms of both security and cost-effectiveness, and is also slated to become a favorite among cryptocurrencies, as it can also handle proof-of-work operations.
The other major change in PHP 7.2 was the removal of the old Mcrypt cryptographic library from the PHP core and the addition of Libsodium, a more modern alternative.
Of all changes, the most significant is, by far, the support for Argon2, a password hashing algorithm developed in the early 2010s. Back in 2015, Argon2 beat 23 other algorithms to win the Password Hashing Competition, and is now in the midst of becoming a universally recognized Internet standard at the Internet Engineering Task Force (IETF), the reward for winning the contest. The algorithm is currently considered to be superior to Bcrypt, today's most widely used password hashing function, in terms of both security and cost-effectiveness, and is also slated to become a favorite among cryptocurrencies, as it can also handle proof-of-work operations.
The other major change in PHP 7.2 was the removal of the old Mcrypt cryptographic library from the PHP core and the addition of Libsodium, a more modern alternative.
I just got done converting everything to bcrypt!
So now all we have to worry about with PHP is everything else.
Confucius say, "Find worm in apple - bad. Find half a worm - worse."
Facebook, Laravel, Own/Nextcloud, Wikipedia, Wordpress, ... more than 80% of the web runs on PHP.
Custom electronics and digital signage for your business: www.evcircuits.com
I usually store passwords salted and hashed 100 to 500 thousand times with SHA-256 or MD5.
Should I switch to this now ?
Write boring code, not shiny code!
If I understand correctly, Argon2 is "memory hard" hashing. It takes a lot of memory to run efficiently in an effort to confound FPGAs and ASICs. How is this supposed to work in an embedded system such as IoT? Those devices are very tiny and might not have enough memory. Isn't delaying 1 second after a failed password attempt enough?
Author knows nothing about security. Updated crypto algorithms / libraries have next to nothing to do with application security.
How many apps are hacked through outdated crypto algorithms? Now how many are hacked through unchecked user input, careless key/password handling, privilege escalation, default passwords, sensitive files left in open locations, and other programming errors?
There's a reason OpenBSD is one of (if not the) most secure operating systems. Code audits, careful input / output checking, sane error handling, etc. It has nothing to do with crypto algorithms.
Democracy is two wolves and a sheep voting on lunch.
Uh... https://developers.slashdot.org/story/17/02/21/2039256/php-becomes-first-programming-language-to-add-modern-cryptography-library-in-its-core
And don't forget https://developers.slashdot.or...
#DeleteFacebook
PHP got a whole lot more secure this week with the release of the 7.2 branch, a version that improves and modernizes the language's support for cryptography and password hashing algorithms.
Adding new cryptography and hashing methods doesn't make the language itself more secure.
systemd is Roko's Basilisk.
Facebook, Laravel, Own/Nextcloud, Wikipedia, Wordpress, ... more than 80% of the web runs on PHP.
I've heard of maybe half of those, I didn't realize all of them were still around.
I remember letting people run php on my shell/web server some 15 years ago. And how quickly the default installation was hacked and webpages were defaced. For me it wasn't worth the effort necessary to set it up properly.
“Common sense is not so common.” — Voltaire
My own tests with Argon2 prove that with it's lowest setting it loads my current server down too much for the hash rate I was getting with bcrypt. I do not have the ability to fine tune it's server load well enough at this point so I've not switched over password hashing to it at this time. Also, I have less free RAM than I'd like to allocate so the benefits of argon2 are significantly limited for me at this time... It is going to be a trade off between server resources and massively parallel GPU attacks and the RAM use is primarily the new defense of Argon2 (not so much parallelism since that is still an area of growth for hardware.)
I've seen tests run with GPU hashing implementing a huge list of algorithms where bcrypt was 100x better than everything else and for the test it was only set to 5! Nobody uses bcrypt set at complexity 5! no benchmarks vs Argon2 other than my own (using server cpus.)
Somebody with bcrypt in FPGAs might knock the wind out of it but bcrypt at level 10+? Going forward, I've already been migrating to argon2 and I will look into formatting it into standard password hash format now that I know it's being used this way; however, I will still be limiting it until server upgrades... and further Argon2 benchmarks performed on gpus, fpgas because it won't matter if my server needs weaken Argon2 too much. (At which point I guess we need to start getting gpus for servers?)
Democracy Now! - uncensored, anti-establishment news
CREIMER' SUBMISSIONS UPDATE: /. so make sure to go to:
Note also that creimer is trying to regain karma by getting his submissions published as articles on
https://slashdot.org/~cdreimer
and mod down his submissions as well. The great thing is that you don't even need mod points to mod down a submission, just click on the "minus" icon!
creimer wrote:
I don't bother with mod points. I'm doing something much more sinister. It took ten story submissions ? I'll have to double check the number ? to move cdreimer's karma from neutral to excellent without ever being exposed to the capricious mods. Mmmmmwwwwahahahahahahaha!
https://slashdot.org/comments....
Danger, Will Robinson, Danger! Creimy is posting more than 2 posts a day. Hurry! mod down otherwise /. will go to hell again!
Note: you can mod down even if already at -1 to lower karma and to prevent lost /. users to accidentally mod up.
creimer wrote:
All you need to do is find a website with a permissive TOS, say, Slashdot, create a Python script to scrape your own comments, sprinkle Amazon affiliate links in various posts, and then re-post past links whenever possible. Won't be long before you start making "coffee money" each month.
https://slashdot.org/comments....
C.D. Reimer is a renowned Slashdot collaborator, as he puts it himself; "Because of the quality of my posts and my article submissions, I'm a highly rated commentator and moderator."
But does anybody ever wondered what "C.D." stands for? Well, it stands for Creimy Dumpty of course!
Creimy Dumpty sat on the wall,
Creimy Dumpty had a great fall.
All the king's horses
And all the king's men
Couldn't put Creimy Dumpty
Together again.
Creimy's siblings video and theme song, very realistic, especially the pants, just like Creimy's:
https://www.youtube.com/watch?...
With "Vice President Pence Vowing US Astronauts Will Return To the Moon", we are sure they will need miracle workers up there, here is what it would look like. Note that Creimy takes care of bringing a lot of food to the moon as depicted below:
https://www.youtube.com/watch?...
Creimy's real pictures:
Before the sex change:
https://ibb.co/cc7Ddw
After the sex change:
https://ibb.co/gVad65
Creimy's "enterprise-level" chair, he talks about it all the time on slashdot:
http://www.keynamics.com/image...
Creimy's head, while his supervisor was talking to him, not with him, since it is impossible to do with Creimy:
http://ibb.co/mRVSaG
Creimy acting in educational resource document, he actually confirmed himself on Slashdot that he was handled by Special Education for the Santa Clara County Office of Education! He is really a king Dumpty!:
http://www.sccoe.org/depts/stu...
There was a mismatch between the specification and the example code/known answers.
Unless that's been fixed in the last few weeks anyone implementing Argon2 will get burned.
The PHP crew doesn't hesitate for a second to add in a feature that's useful. PHP gets the job done and that's why it's still holding it's ground even after each and every rails and node fad that comes along.
We suffer more in our imagination than in reality. - Seneca