Re: [PHP-DEV] hash_hkdf() signature

2017-02-08 Thread Yasuo Ohgaki
Hi all and Scott, On Wed, Feb 8, 2017 at 11:22 PM, Scott Arciszewski wrote: > On Wed, Feb 8, 2017 at 6:27 AM, Andrey Andreev wrote: > >> Hi, >> >> On Tue, Feb 7, 2017 at 10:22 PM, Scott Arciszewski >> wrote: >> >>> >>> >>> Although the RFC itself says that salts are optional, the argument to >

Re: [PHP-DEV] hash_hkdf() signature

2017-02-08 Thread Yasuo Ohgaki
Hi Andrey, On Wed, Feb 8, 2017 at 8:27 PM, Andrey Andreev wrote: > On Tue, Feb 7, 2017 at 10:22 PM, Scott Arciszewski > wrote: > >> >> >> Although the RFC itself says that salts are optional, the argument to >> make them required in PHP's implementation has merit. The only downside is: >> If yo

Re: [PHP-DEV] Namespaces in Core

2017-02-08 Thread Sara Golemon
On Tue, Feb 7, 2017 at 6:59 PM, Dan Ackroyd wrote: > On 7 February 2017 at 17:56, Scott Arciszewski wrote: >> I'm taking all the No votes spawned by this thread to mean "we >> don't want namespaced functions ever". > > That would be a bad assumption. > Confirmed. I'm not against EVER having names

[PHP-DEV] BAD Benchmark Results for PHP Master 2017-02-07

2017-02-08 Thread lp_benchmark_robot
Results for project PHP master, build date 2017-02-07 20:28:50-08:00 commit: 4ec8066 previous commit:31332d0 revision date: 2017-02-08 01:10:54+01:00 environment:Haswell-EP cpu:Intel(R) Xeon(R) CPU E5-2699 v3 @ 2.30GHz 2x18 cores, stepping 2, LLC 45 MB

Re: [PHP-DEV] php7 php_str_to_str warning: assignment makes pointer from integer without a cast

2017-02-08 Thread Torsten Rosenberger
Am Mittwoch, den 08.02.2017, 14:16 +0100 schrieb Nikita Popov: > On Wed, Feb 8, 2017 at 2:02 PM, Torsten Rosenberger eb.at> > wrote: > > > > > Hello > > > > prehistory: > > i tried to use php_str_to_str function to replace some character > > insteed of use call_user_func with str_replace > > >

Re: [PHP-DEV] hash_hkdf() signature

2017-02-08 Thread Scott Arciszewski
On Wed, Feb 8, 2017 at 4:16 AM, Yasuo Ohgaki wrote: > Hi Scott, > > There are applications that do not require salt. In this case, all users > has to do is > $salt = NULL > to omit $salt. > Great. On Wed, Feb 8, 2017 at 6:27 AM, Andrey Andreev wrote: > Hi, > > On Tue, Feb 7, 2017 at 10:22 PM

Re: [PHP-DEV] [Discussion] FFI in PHP

2017-02-08 Thread Michael Wallner
On 08/02/17 14:54, Michał Brzuchalski wrote: > 2017-02-08 12:51 GMT+01:00 Michael Wallner : > >> >> ``` >> // https://github.com/m6w6/ext-psi#implementations >> function math\add(int $a, int $b) : int { >> let a = intval($a); >> let b = intval($b); >> return to_int(add); >>

Re: [PHP-DEV] [Discussion] FFI in PHP

2017-02-08 Thread Michał Brzuchalski
2017-02-08 12:51 GMT+01:00 Michael Wallner : > On 05/02/17 23:25, Alex Bowers wrote: > > And here is the previous messaging without borked formatting. Sorry > folks. > > > > > > FFI RFC > > == > ... > > Example > > === > > > > Take an example of a rust program that takes two numbers in and giv

Re: [PHP-DEV] php7 php_str_to_str warning: assignment makes pointer from integer without a cast

2017-02-08 Thread Nikita Popov
On Wed, Feb 8, 2017 at 2:02 PM, Torsten Rosenberger wrote: > Hello > > prehistory: > i tried to use php_str_to_str function to replace some character > insteed of use call_user_func with str_replace > > in ext/standard/string.c > PHPAPI zend_string *php_str_to_str(char *haystack, size_t length, c

[PHP-DEV] php7 php_str_to_str warning: assignment makes pointer from integer without a cast

2017-02-08 Thread Torsten Rosenberger
Hello prehistory: i tried to use php_str_to_str function to replace some character insteed of use call_user_func with str_replace  in ext/standard/string.c  PHPAPI zend_string *php_str_to_str(char *haystack, size_t length, char *needle, size_t needle_len, char *str, size_t str_len); so i expect

Re: [PHP-DEV] [Discussion] FFI in PHP

2017-02-08 Thread Michael Wallner
On 05/02/17 23:25, Alex Bowers wrote: > And here is the previous messaging without borked formatting. Sorry folks. > > > FFI RFC > == ... > Example > === > > Take an example of a rust program that takes two numbers in and gives > you the sum of them. > > ```rust > #[no_mangle] > pub extern

Re: [PHP-DEV] hash_hkdf() signature

2017-02-08 Thread Andrey Andreev
Hi, On Tue, Feb 7, 2017 at 10:22 PM, Scott Arciszewski wrote: > > > Although the RFC itself says that salts are optional, the argument to make > them required in PHP's implementation has merit. The only downside is: If > you're integrating with an implementation that doesn't require salts, and >

Re: [PHP-DEV] hash_hkdf() signature

2017-02-08 Thread Yasuo Ohgaki
Forgot to mention the most important. On Wed, Feb 8, 2017 at 6:16 PM, Yasuo Ohgaki wrote: > Is that enough of a downside to dismiss an argument for better security? > Maybe I suppose so. It is very clear that "salt" is the most important for derived key security, "info" is next, then "length".

Re: [PHP-DEV] hash_hkdf() signature

2017-02-08 Thread Yasuo Ohgaki
Hi Scott, On Wed, Feb 8, 2017 at 5:22 AM, Scott Arciszewski wrote: > > One such real-world use case: Defuse v1 used HKDF without a salt. > > https://github.com/defuse/php-encryption/blob/ > b87737b2eec06b13f025cabea847338fa203d1b4/Crypto.php#L157-L170 > https://github.com/defuse/php-encryption/b