The PHP password_hash() function supports hashing passwords with the Argon2 hashing algorithm currently recommended by OWASP if php is compiled against one of the following libraries:
Only one of the libraries is required, but it doesn't hurt to add both. E.g., Debian does that.
Both libraries in PHP since 7.2 realese
Add following build options
--with-password-argon2 \
--with-sodium \
and add libargon2 and libsodium23 dependencies
split into commits and cherry-pick to production
Show commandsStart within a Git clone of the project using the version control instructions.
Or, if you do not have SSH keys set up on git.drupalcode.org:
changes, plain diff MR !55
Comments
Comment #3
znerol commentedAdded both libraries in the PR (sodium and argon2). It's the way debian php is built.
It would be possible to minimize dependencies by not adding sodium at all and stick with argon2 library. From PHP 8.4, even that one is not necessary anymore. From that version onwards it is possible to use OpenSSL Argon2 implementation. Question here: Is it preferable to remain close to what distros are shipping or is it preferable to minimize dependencies.
Test command and example result for images with argon2 support:
Comment #4
andypostLooks totally ok to me, I will commit it later tonight
btw I found OpenSSL argon is incomplete implementation so better to link it directly to the library.
so when there's no Argon2 headers some functionality is missing
Comment #5
andypostComment #7
andypostI gonna slit it on commits as franken in dev repo only and looks can't build
Comment #9
andypostand
Comment #15
andypost