什麼是PHP手冊中password_hash

Question

成本的選擇是大量的實例使用password_hash 一些成本例如用來計算性價比不錯

<?php 
/** 
* This code will benchmark your server to determine how high of a cost you can 
* afford. You want to set the highest cost that you can without slowing down 
* you server too much. 8-10 is a good baseline, and more is good if your servers 
* are fast enough. The code below aims for ≤ 50 milliseconds stretching time, 
* which is a good baseline for systems handling interactive logins. 
*/ 
$timeTarget = 0.05; // 50 milliseconds 

$cost = 8; 
do { 
$cost++; 
$start = microtime(true); 
password_hash("test", PASSWORD_BCRYPT, ["cost" => $cost]); 
$end = microtime(true); 
} while (($end - $start) < $timeTarget); 

echo "Appropriate Cost Found: " . $cost . "\n"; 
?> 

成本立場？

Answer 1

從wikipedia：

成本參數指定一個密鑰擴展迭代計數作爲 兩個電源，其是輸入到隱窩算法。

Answer 2

https://wildlyinaccurate.com/bcrypt-choosing-a-work-factor/

之所以密鑰的建立相可以是潛在地昂貴的，因爲它運行2 ^工作倍。由於密碼散列通常與常用任務相關，例如將用戶登錄到系統中，因此在安全性和性能之間找到適當的平衡非常重要。使用高工作因子使得執行強力攻擊非常困難，但是會給系統帶來不必要的負擔。