Skip to content

Commit 0d4d8ea

Browse files
charlesportwoodiicharlesportwoodii
committed
Removing Argon2d, changing config arg to --with-password-argon2
Argon2d is not suitable for password_hashing. To ensure best practices within password_*, Argon2d was removed. --with-argon2 implies the full feature set of Argon2, whereas this feature only implements Argon2i within password_*. Consequently the feature flag was renamed to --with-password-argon2
1 parent ab837a6 commit 0d4d8ea

File tree

8 files changed

+15
-61
lines changed

8 files changed

+15
-61
lines changed

‎ext/standard/config.m4

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -553,8 +553,8 @@ AC_CHECK_DECLS([getrandom])
553553
dnl
554554
dnl Check for argon2
555555
dnl
556-
PHP_ARG_WITH(argon2, for Argon2 support,
557-
[ --with-argon2[=DIR] Include Argon2 support in password_*. DIR is the Argon2 shared library path]])
556+
PHP_ARG_WITH(password-argon2, for Argon2 support,
557+
[ --with-password-argon2[=DIR] Include Argon2 support in password_*. DIR is the Argon2 shared library path]])
558558

559559
if test "$PHP_ARGON2" != "no"; then
560560
AC_MSG_CHECKING([for Argon2 library])

‎ext/standard/config.w32

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
// vim:ft=javascript
22
// $Id$
33

4-
ARG_WITH("argon2", "Argon2 support", "no");
4+
ARG_WITH("password-argon2", "Argon2 support", "no");
55

66
if (PHP_ARGON2 != "no") {
77
if (CHECK_LIB("Argon2Ref.lib", null, PHP_ARGON2)

‎ext/standard/password.c

Lines changed: 2 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,6 @@ PHP_MINIT_FUNCTION(password) /* {{{ */
4545
REGISTER_LONG_CONSTANT("PASSWORD_BCRYPT", PHP_PASSWORD_BCRYPT, CONST_CS | CONST_PERSISTENT);
4646
#if HAVE_ARGON2LIB
4747
REGISTER_LONG_CONSTANT("PASSWORD_ARGON2I", PHP_PASSWORD_ARGON2I, CONST_CS | CONST_PERSISTENT);
48-
REGISTER_LONG_CONSTANT("PASSWORD_ARGON2D", PHP_PASSWORD_ARGON2D, CONST_CS | CONST_PERSISTENT);
4948
REGISTER_LONG_CONSTANT("PASSWORD_ARGON2", PHP_PASSWORD_ARGON2, CONST_CS | CONST_PERSISTENT);
5049
#endif
5150

@@ -68,8 +67,6 @@ static char* php_password_get_algo_name(const php_password_algo algo)
6867
#if HAVE_ARGON2LIB
6968
case PHP_PASSWORD_ARGON2I:
7069
return "argon2i";
71-
case PHP_PASSWORD_ARGON2D:
72-
return "argon2d";
7370
#endif
7471
case PHP_PASSWORD_UNKNOWN:
7572
default:
@@ -85,8 +82,6 @@ static php_password_algo php_password_determine_algo(const char *hash, const siz
8582
#if HAVE_ARGON2LIB
8683
if (len >= sizeof("$argon2i$")-1 && !memcmp(hash, "$argon2i$", sizeof("$argon2i$")-1)) {
8784
return PHP_PASSWORD_ARGON2I;
88-
} else if (len >= sizeof("$argon2d$")-1 && !memcmp(hash, "$argon2d$", sizeof("$argon2d$")-1)) {
89-
return PHP_PASSWORD_ARGON2D;
9085
}
9186
#endif
9287

@@ -198,14 +193,13 @@ PHP_FUNCTION(password_get_info)
198193
break;
199194
#if HAVE_ARGON2LIB
200195
case PHP_PASSWORD_ARGON2I:
201-
case PHP_PASSWORD_ARGON2D:
202196
{
203197
zend_long v = 0;
204198
zend_long m_cost = PHP_PASSWORD_ARGON2_MEMORY_COST;
205199
zend_long t_cost = PHP_PASSWORD_ARGON2_TIME_COST;
206200
zend_long threads = PHP_PASSWORD_ARGON2_THREADS;
207201

208-
sscanf(hash, "$%*[argon2id]$v=" ZEND_LONG_FMT "$m=" ZEND_LONG_FMT ",t=" ZEND_LONG_FMT ",p=" ZEND_LONG_FMT, &v, &m_cost, &t_cost, &threads);
202+
sscanf(hash, "$%*[argon2i]$v=" ZEND_LONG_FMT "$m=" ZEND_LONG_FMT ",t=" ZEND_LONG_FMT ",p=" ZEND_LONG_FMT, &v, &m_cost, &t_cost, &threads);
209203
add_assoc_long(&options, "m_cost", m_cost);
210204
add_assoc_long(&options, "t_cost", t_cost);
211205
add_assoc_long(&options, "threads", threads);
@@ -263,7 +257,6 @@ PHP_FUNCTION(password_needs_rehash)
263257
break;
264258
#if HAVE_ARGON2LIB
265259
case PHP_PASSWORD_ARGON2I:
266-
case PHP_PASSWORD_ARGON2D:
267260
{
268261
zend_long v = 0;
269262
zend_long new_m_cost = PHP_PASSWORD_ARGON2_MEMORY_COST, m_cost = 0;
@@ -282,7 +275,7 @@ PHP_FUNCTION(password_needs_rehash)
282275
new_threads = zval_get_long(option_buffer);
283276
}
284277

285-
sscanf(hash, "$%*[argon2id]$v=" ZEND_LONG_FMT "$m=" ZEND_LONG_FMT ",t=" ZEND_LONG_FMT ",p=" ZEND_LONG_FMT, &v, &m_cost, &t_cost, &threads);
278+
sscanf(hash, "$%*[argon2i]$v=" ZEND_LONG_FMT "$m=" ZEND_LONG_FMT ",t=" ZEND_LONG_FMT ",p=" ZEND_LONG_FMT, &v, &m_cost, &t_cost, &threads);
286279

287280
if (new_t_cost != t_cost || new_m_cost != m_cost || new_threads != threads) {
288281
RETURN_TRUE;
@@ -317,16 +310,9 @@ PHP_FUNCTION(password_verify)
317310
switch(algo) {
318311
#if HAVE_ARGON2LIB
319312
case PHP_PASSWORD_ARGON2I:
320-
case PHP_PASSWORD_ARGON2D:
321313
{
322314
argon2_type type = Argon2_i;
323315

324-
if (algo == PHP_PASSWORD_ARGON2I) {
325-
type = Argon2_i;
326-
} else if (algo == PHP_PASSWORD_ARGON2D) {
327-
type = Argon2_d;
328-
}
329-
330316
status = argon2_verify(hash, password, password_len, type);
331317

332318
if (status == ARGON2_OK) {
@@ -412,7 +398,6 @@ PHP_FUNCTION(password_hash)
412398
break;
413399
#if HAVE_ARGON2LIB
414400
case PHP_PASSWORD_ARGON2I:
415-
case PHP_PASSWORD_ARGON2D:
416401
{
417402
if (options && (option_buffer = zend_hash_str_find(options, "m_cost", sizeof("m_cost")-1)) != NULL) {
418403
m_cost = zval_get_long(option_buffer);
@@ -441,12 +426,6 @@ PHP_FUNCTION(password_hash)
441426
RETURN_NULL();
442427
}
443428

444-
if (algo == PHP_PASSWORD_ARGON2D) {
445-
type = Argon2_d;
446-
} else if (algo == PHP_PASSWORD_ARGON2I) {
447-
type = Argon2_i;
448-
}
449-
450429
required_salt_len = 16;
451430
}
452431
break;
@@ -547,7 +526,6 @@ PHP_FUNCTION(password_hash)
547526
break;
548527
#if HAVE_ARGON2LIB
549528
case PHP_PASSWORD_ARGON2I:
550-
case PHP_PASSWORD_ARGON2D:
551529
{
552530
size_t out_len = 32;
553531
size_t encoded_len;

‎ext/standard/php_password.h

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -43,8 +43,7 @@ typedef enum {
4343
PHP_PASSWORD_UNKNOWN,
4444
PHP_PASSWORD_BCRYPT,
4545
#if HAVE_ARGON2LIB
46-
PHP_PASSWORD_ARGON2D,
47-
PHP_PASSWORD_ARGON2I
46+
PHP_PASSWORD_ARGON2I,
4847
#endif
4948
} php_password_algo;
5049

‎ext/standard/tests/password/password_get_info_argon2.phpt

Lines changed: 2 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -6,16 +6,14 @@ if (!defined('PASSWORD_ARGON2')) die('Skipped: password_get_info not built with
66
?>
77
--FILE--
88
<?php
9-
// Test Argon2i
9+
1010
var_dump(password_get_info('$argon2i$v=19$m=65536,t=3,p=1$SWhIcG5MT21Pc01PbWdVZw$WagZELICsz7jlqOR2YzoEVTWb2oOX1tYdnhZYXxptbU'));
11-
// Test Argon2d
12-
var_dump(password_get_info('$argon2d$v=19$m=32768,t=2,p=1$YWpxd0VYRW9MLmp6VjFPZw$pWV5IsbBfjEK5c0bHzvAo0FsDNHUyM4p6j8vf2cxzb8'));
1311
echo "OK!";
1412
?>
1513
--EXPECT--
1614
array(3) {
1715
["algo"]=>
18-
int(3)
16+
int(2)
1917
["algoName"]=>
2018
string(7) "argon2i"
2119
["options"]=>
@@ -28,19 +26,4 @@ array(3) {
2826
int(1)
2927
}
3028
}
31-
array(3) {
32-
["algo"]=>
33-
int(2)
34-
["algoName"]=>
35-
string(7) "argon2d"
36-
["options"]=>
37-
array(3) {
38-
["m_cost"]=>
39-
int(32768)
40-
["t_cost"]=>
41-
int(2)
42-
["threads"]=>
43-
int(1)
44-
}
45-
}
4629
OK!

‎ext/standard/tests/password/password_hash_argon2.phpt

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -14,13 +14,9 @@ var_dump(password_verify($password, $hash));
1414
$hash = password_hash($password, PASSWORD_ARGON2I);
1515
var_dump(password_verify($password, $hash));
1616

17-
$hash = password_hash($password, PASSWORD_ARGON2D);
18-
var_dump(password_verify($password, $hash));
19-
2017
echo "OK!";
2118
?>
2219
--EXPECT--
2320
bool(true)
2421
bool(true)
25-
bool(true)
2622
OK!

‎ext/standard/tests/password/password_needs_rehash_argon2.phpt

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,12 +6,16 @@ if (!defined('PASSWORD_ARGON2')) die('Skipped: password_get_info not built with
66
?>
77
--FILE--
88
<?php
9-
var_dump(password_needs_rehash('$argon2i$v=19$m=65536,t=3,p=1$YkprUktYN0lHQTd2bWRFeA$79aA+6IvgclpDAJVoezProlqzIPy7do/P0sBDXS9Nn0', PASSWORD_ARGON2, ['m_cost' => 1<<17]));
10-
var_dump(password_needs_rehash('$argon2i$v=19$m=65536,t=3,p=1$YkprUktYN0lHQTd2bWRFeA$79aA+6IvgclpDAJVoezProlqzIPy7do/P0sBDXS9Nn0', PASSWORD_ARGON2, ['t_cost' => 2]));
11-
var_dump(password_needs_rehash('$argon2i$v=19$m=65536,t=3,p=1$YkprUktYN0lHQTd2bWRFeA$79aA+6IvgclpDAJVoezProlqzIPy7do/P0sBDXS9Nn0', PASSWORD_ARGON2, ['threads' => 2]));
9+
10+
$hash = '$argon2i$v=19$m=65536,t=3,p=1$YkprUktYN0lHQTd2bWRFeA$79aA+6IvgclpDAJVoezProlqzIPy7do/P0sBDXS9Nn0';
11+
var_dump(password_needs_rehash($hash, PASSWORD_ARGON2));
12+
var_dump(password_needs_rehash($hash, PASSWORD_ARGON2, ['m_cost' => 1<<17]));
13+
var_dump(password_needs_rehash($hash, PASSWORD_ARGON2, ['t_cost' => 2]));
14+
var_dump(password_needs_rehash($hash, PASSWORD_ARGON2, ['threads' => 2]));
1215
echo "OK!";
1316
?>
1417
--EXPECT--
18+
bool(false)
1519
bool(true)
1620
bool(true)
1721
bool(true)

‎ext/standard/tests/password/password_verify_argon2.phpt

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -7,10 +7,6 @@ if (!defined('PASSWORD_ARGON2')) die('Skipped: password_get_info not built with
77
--FILE--
88
<?php
99

10-
var_dump(password_verify('test', '$argon2d$v=19$m=32768,t=2,p=1$YWpxd0VYRW9MLmp6VjFPZw$pWV5IsbBfjEK5c0bHzvAo0FsDNHUyM4p6j8vf2cxzb8'));
11-
12-
var_dump(password_verify('argon2', '$argon2d$v=19$m=32768,t=2,p=1$YWpxd0VYRW9MLmp6VjFPZw$pWV5IsbBfjEK5c0bHzvAo0FsDNHUyM4p6j8vf2cxzb8'));
13-
1410
var_dump(password_verify('test', '$argon2i$v=19$m=65536,t=3,p=1$OEVjWWs2Z3YvWlNZQ0ZmNw$JKin7ahjmh8JYvMyFcXri0Ss/Uvd3uYpD7MG6C/5Cy0'));
1511

1612
var_dump(password_verify('argon2', '$argon2i$v=19$m=65536,t=3,p=1$OEVjWWs2Z3YvWlNZQ0ZmNw$JKin7ahjmh8JYvMyFcXri0Ss/Uvd3uYpD7MG6C/5Cy0'));
@@ -19,6 +15,4 @@ echo "OK!";
1915
--EXPECT--
2016
bool(true)
2117
bool(false)
22-
bool(true)
23-
bool(false)
2418
OK!

0 commit comments

Comments
 (0)