在PHP 7.3中使用argon2加密而无需重新编译

Question

I want to encrypt passwords using argon2 in php 7.3, but the problem is that I have to recompile php with —with-password-argon2 flag.
The issue is that the current hosting provider doesn't support this. Is there any way to use argon2 in php without recompiling or should I just use bcrypt?

Answer 1

Well, there is a polyfill for libsodium , a library for various cryptographic algorithms, and they state :

It's not feasible to polyfill scrypt or Argon2 into PHP and get reasonable performance. Users would feel motivated to select parameters that downgrade security to avoid denial of service (DoS) attacks.

The only winning move is not to play.

So, no, a pure PHP solution is apparently infeasible. You will need to be able to install some native library in some form or another.

Answer 2

Since PHP 7.2, Sodium is usually bundled with PHP. This library provides high-level function for cryptography (encryption, signature, hash,...).

It provides the sodium_crypto_pwhash_str function ( source ) that uses argon2, and is Sodium is indeed bundled, you shouldn't need to recompile PHP. You should use the parameters given for time and memory options. With a moderate security setting I had this output : $argon2id$v=19$m=262144,t=3,p=1$cH0L6kab+fCGHBE3fEw2bw$leS9TBiPOq1gEGg+O6PxAn/O7XXyVnRLs6ANcHHXfCIroot@vps531354: