On 19/09/2026 12:26, Andrey Andreev wrote:
Hi Anton,
On Sat, Sep 19, 2026 at 5:15 AM Anton Smirnov <[email protected]
<mailto:[email protected]>> wrote:
Did anything change since the last time?
https://externals.io/message/120993#120996 <https://externals.io/
message/120993#120996>
Yes, that thread is from September 2023, more than a year before PHP
8.4's release bringing in the --with-openssl-argon2 flag.
libargon2 and libsodium can't be relied upon to exist on most systems,
but openssl is a very different beast.
There already exists a year-old proposal to enable --with-openssl-argon2
by default (https://github.com/php/php-src/pull/19360 <https://
github.com/php/php-src/pull/19360>). It would be fair to point out that
I am thinking ahead of it, this is exploring potential and there are
plenty of subsequent problems to debate after. But whether the openssl
dependency is acceptable is the most critical one.
Cheers,
Andrey.
My point is mostly about this part:
Argon2 for settings that are reasonable for interactive
authentication is worse than BCrypt
Like, if there were any successful attacks on bcrypt that negate that part
