6 ms·

There are no known good implementation of scrypt in php (http://stackoverflow.com/questions/10149554/are-there-any-php-implementations-of-scrypt http://stackove

• ticks 14y ago
  Even opting for bcrypt can be sketchy. Native support only appeared a few years ago, older versions rely on the OS - many of which didn't support blowfish without a patch. Fine if you control the server.
  • kijin 14y ago
    Since most people who face a choice between bcrypt and scrypt will be the ones who are developing new sites or considering a major upgrade to an old site, I don't think they'll care about compatibility with anything older than PHP 5.2. Even if you don't control the server, it's difficult to find a reputable web host nowadays that still runs anything older than PHP 5.2, and your average cPanel host is most likely to support a wide range of crypto functions.
• exDM69 14y ago
  It's not a very good idea to implement cryptography in a high level language such as PHP. Using a high level language opens a whole new world of pain when it comes to side channel attacks. Timing attacks, cache timing attacks and branch predictor attacks are much easier to protect yourself against if you write your crypto algorithms in C or, preferably, Assembly.
  • jimktrains2 14y ago
    C module?
    • exDM69 14y ago
      Writing your crypto with C and then calling it from another language such as PHP or Python is fine.