Cphalcon: Implement Argon2 for password hashing

[RayHughes]

With the release of PHP 7.2, Argon2 has been available for use for password hashing under the PASSWORD_ARGON2I constant. The upcoming release of PHP 7.3 will build on this and enable PASSWORD_ARGON2D and PASSWORD_ARGON2ID.

Unlike BCRYPT, ARGON2 is resistant to GPU based attacks as it accesses the memory array in a password dependent order, which reduces the possibility of time–memory trade-off attack.

https://en.wikipedia.org/wiki/Argon2
https://password-hashing.net
https://github.com/P-H-C/phc-winner-argon2
http://php.net/manual/en/function.password-hash.php

[JABirchall]

I dont see what needs implimenting? If you use php7.2 you can just use password_hash('password', PASSWORD_ARGON2I) What does phalcon need to impliment here? Unless your asking phalcon to impliment argon to be used on versions < 7.2?

[RayHughes]

I dont see what needs implimenting? If you use php7.2 you can just use password_hash('password', PASSWORD_ARGON2I) What does phalcon need to impliment here? Unless your asking phalcon to impliment argon to be used on versions < 7.2?

Yes you are correct. However, Phalcon has a security wrapper (https://docs.phalconphp.com/hu/3.4/security) that is injectable through the DI container. Using the security component allows users to call it throughout there module with pre-configured properties etc.

Yes you could technically write a wrapper around the password_hash() method and pre configure it yourself but why reinvent the wheel.

This is a framework after all and in its current form it does provide password hashing abilities, so it should either improve on them or drop them completely.

[ViltusVilks]

Yes, it is a framework, which can be "overriden"

1. Extend Phalcon\Security, override needed part
2. Set in DI for security \MyApp\Lib\Whatever\MySecurity

Problem for Argon can be that it needs library/extension and these checks will be done for all "phalcon customers" when upgraded.

Other point - use OAuth2/JWT/SSO with authentication servers (quite easy with Docker deployment) so You can forget about passwords, but will have bit more work to implement authorization layer

[JABirchall]

Yes you are correct. However, Phalcon has a security wrapper (https://docs.phalconphp.com/hu/3.4/security) that is injectable through the DI container.

Ahh ok, So maybe would be best to NFR a $security->setPasswordHashAlgorithme(int $algorithmeConst)

[RayHughes]

Not an available option which was the point for my issue...

[JABirchall]

@RayHughes Thats what I mean, Maybe phalcon should add such a method to allow devs choose which hashing function to use since PHP has so many now and are prolly going to add more.

[RayHughes]

@JABirchall my bad on the interpretation and I agree with your suggestion.

[niden]

Closing in favor of #13855. Will revisit if the community votes for it, or in later versions.