Increase default time cost for argon2 password hashing

Author: sgolemon

NEWS

@@ -11,6 +11,7 @@ PHP                                                                        NEWS
     (Ryan McCullagh, Nikita)
   . Fixed bug #75921 (Inconsistent: No warning in some cases when stdObj is
     created on the fly). (David Walker)
+  . Increased default time_cost for argon2i(d) password_hash to 3. (Sara)
 
 - COM:
   . Deprecated registering of case-insensitive constants from typelibs. (cmb)

ext/standard/php_password.h

@@ -34,7 +34,7 @@ PHP_MSHUTDOWN_FUNCTION(password);
 
 #if HAVE_ARGON2LIB
 #define PHP_PASSWORD_ARGON2_MEMORY_COST 1<<10
-#define PHP_PASSWORD_ARGON2_TIME_COST 2
+#define PHP_PASSWORD_ARGON2_TIME_COST 3
 #define PHP_PASSWORD_ARGON2_THREADS 2
 #endif