Discussion
PHP 8.7
Add PASSWORD_BCRYPT_WRAP
From the RFC
Bcrypt's 72-byte limit on passwords and issue with null bytes are inviting many userspace workarounds, poor tradeoffs, security vulnerabilities, UX issues, and considerable toil for developers. Attempts to (partially or fully) solve these problems have so far failed, for reasons ranging from concerns over backwards-compatibility and degraded UX, to external dependencies being prohobitive of another default algorithm. Contributing to the stalemate are also prominent opinions that Bcrypt still offers best-in-class protection against hash cracking, when resource constraints of web applications ar...Read the full RFC on wiki.php.net →