New authentication configuration
Now we have finally said goodbye to PHP 5.4 we can begin to improve even further our tools used to create and verify password hashes. Since XF 2.0 we have already attempted to use the following functions which were added in PHP 5.5 if they were available:
Now everyone will be running PHP 5.6 as a minimum, we can solely use these native PHP functions for all our password hashing needs.
Since
XF 1.2 we have used Bcrypt for our password hashes, this was before it was even natively supported by PHP and even today it remains to be the default hashing algorithm for even PHP 7.2 and 7.3.
But, over time, PHP will add additional hashing methods, and it would be ideal if we could just support them out of the box without us having to make any code changes. The aforementioned functions serve as a consistent interface and therefore get us part of the way there towards being that flexible, but until now there wasn't actually a straightforward way to use a different algorithm if one was available, or support a more granular configuration.
However, PHP actually
has implemented (technically) two new password hashing algorithms based around
Argon2. This was first introduced in PHP 7.2 using a variant known as Argon2i and it is further improved in PHP 7.3 using a variant known as Argon2id.
By default, XF will always aim to use the default or most widely supported password hashing algorithm available, so in this case that is still Bcrypt. But should you have an appropriate PHP version and the required prerequisites installed (PHP has to be compiled explicitly with Argon2 support) then we should allow you to use that, so in XF 2.1, now you can. And it's as simple as a couple of additional lines in
src/config.php.
The following will enable Argon2i support if you're using PHP 7.2:
PHP:
$config['auth'] = [
'algo' => PASSWORD_ARGON2I
];
The following will enable Argon2id support if you're using PHP 7.3:
PHP:
$config['auth'] = [
'algo' => PASSWORD_ARGON2ID
];
And, although not required because the PHP defaults should be sufficient (and will potentially increase over time), you can even make your password hashes even more secure by passing in additional parameters to control various cost factors:
PHP:
$config['auth'] = [
'algo' => PASSWORD_ARGON2ID,
'options' => [
'memory_cost' => 1<<17,
'time_cost' => 4,
'threads' => 2
]
];
Thanks to the flexibility of the password hashing API in PHP, any changes to the algorithm and options will automatically cause existing passwords to be rehashed when a user logs in.
Although we'd highly recommend using the latest PHP version we support, and also recommend using Argon2i/id hashing where available, you do have to plan carefully should you ever need to downgrade PHP or move to a different server. If Argon2 suddenly becomes unavailable for any reason, then you will likely encounter errors and be unable to verify any passwords without doing a password reset first.
