ext/standard: notice on long passwords in bcrypt

[Sjord]

Bcrypt supports passwords up to 72 characters. The remainder is ignored.

Earlier proposed here:

• https://news-web.php.net/php.internals/75692
• https://wiki.php.net/rfc/password_hash_spec
• https://bugs.php.net/bug.php?id=67653

Bcrypt truncation can result in serious security bugs:

• https://pentesterlab.com/blog/freshrss-bcrypt-truncation-auth-bypass
• https://www.invicti.com/blog/web-security/okta-vulnerability-bcrypt-auth

[Sjord]

This could also apply to crypt. However, with crypt there is not a distinction between creating the hash and verifying the hash, as there is with password_hash / password_verify, which means that anyone that can access to login screen can trigger the notice by entering a long password. That makes the notice less meaningful and bigger chance of BC break.

[Sjord]

@nikic @narfbg @ircmaxell I am looking into this again, and you seemed to have objected last time. Do you feel the same now?

This is mostly for the case where some static string is prepended to the password before being passed to password_hash, and not so much for the case where users actually use 72 character passwords.

[narfbg]

Thanks for the ping, @Sjord.

I do still think that warnings would do more harm than good.

However, I might not be against a fail-closed approach where an exception is thrown. Not to say that I'd outright support that (the BC break can be too big a price to pay) but it would solve most of the problems I have with the warning idea.