[Sjord]

During the discussion on the 72-byte limit of bcrypt, Tim suggested implementing passlib's bcrypt-sha256. That does a HMAC of the password before passing it to bcrypt, solving the 72-byte limit and also the null-byte problem.

This implements bcrypt-sha256 as an algorithm to pass to password_hash / _verify.

RFC: https://wiki.php.net/rfc/bcrypt_sha256

[Sjord]

Ping @TimWolla @narfbg. I vibe-coded bcrypt sha256 support for password_hash / _verify.

[TimWolla]

This test should likely be marked as slow.

[TimWolla]

From what I see this is not resolved.

[Sjord]

I didn't mark it as slow, but I changed the test to be faster. This test now takes approximately 0.2 seconds on my system.

There's one testcase that needs testing and is slow: the default cost of 12. I moved that to password_bcrypt_sha256_hash_slow.phpt and added a SKIPIF SKIP_SLOW_TESTS to that.

[divinity76]

What is the benefits of HMAC here? Sounds unnecessary complexity,
compared to something like bcrypt(hex(sha256(password)), salt)

[Sjord]

What is the benefits of HMAC here?

It is explained in this issue: https://foss.heptapod.net/python-libs/passlib/-/work_items/114

Basically, some other site breach may leak sha256(password), and those hashes can then be checked against bcrypt(sha256(password)). Doing HMAC with the salt prevents this.