New in Symfony 3.4: Argon2i password hasher

Contributed by
Zan Baldwin
in #21604.

Symfony recommends to use the Bcrypt password hasher to hash the passwords of your applications. Bcrypt was specifically designed for long-term password storage and it's natively supported by PHP.

However, security is a fast-moving field where new best practices and recommendations emerge continuously. In recent months, Argon2 hashing algorithm popularity has exploded, especially since winning the 2015 Password Hashing competition. In fact, PHP 7.2 (to be released at the end of 2017) includes built-in support for Argon2.

That's why we decided to include an Argon2i password hasher in Symfony 3.4. First, if you don't use PHP 7.2, add support for Argon2 installing the Libsodium PHP extension in your server or adding the libsodium-php library to your project. Then, use argon2i as the algorithm of the password hasher:

1
2
3
4
5
6
7
# app/config/security.yml
security:
    # ...

    encoders:
        Symfony\Component\Security\Core\User\User:
            algorithm: 'argon2i'

In existing applications using Bcrypt with a reasonably high hashing cost, there's no immediate need to rehash all the passwords using Argon2i. However, if you are creating a new project, you could consider using this new password hashing algorithm.

Comments

Thanks,
Is there stats (speed, security lvl etc?)
Thanks ,
@Clement Roupioz,

https://github.com/p-h-c/phc-winner-argon2
Are the links to the Libsodium PHP extension and the libsodium-php library mixed up? Because "Libsodium PHP extension" links to "Sodium Compat" which is a php polyfill library that cannot be installed in a server while the "libsodium-php library" is an actual PHP extension that needs to be installed in a server and cannot be simply added to a project.
@Ulf thanks for reporting this issue. I've just fixed it.
Login with SensioLabsConnect to post a comment