Re: new crypt implementation, latest DES version used, blowfish support
[email protected] ("Pierre Joye")
| Newsgroups | php.internals.win |
|---|---|
| Message-ID | <[email protected]> |
Hi, On Sun, Jul 20, 2008 at 5:55 PM, Pierre Joye <[email protected]> wrote: > What do you think about enabling Blowfish and extended DES for the > unix as well (when the libc does not have them obviously)? I discussed this patch and addition with Stefan Esser this morning. He also likes the idea of enabling both when necessary for all platforms. One thing I will have to change in my patch is the blowfish salt generation. Apparently some users were smart enough to store generated password in the DB without having used a salt. As it is not portable, it may break an app running on the same host. I'll try to update the documentation with some recommendations (there is really crazy things being done with crypt...). Cheers, -- Pierre http://blog.thepimp.net | http://www.libgd.org