Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[FEATURE] Add Password Hashing Benchmarks #9

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

MarcoPNS
Copy link

This PR adds comprehensive password hashing benchmarks to test the performance characteristics of PHP's built-in password hashing functions. The new benchmarks help developers make informed decisions about password hashing configurations in their applications.

Features added:

  • Bcrypt benchmarks with various cost parameters (4-12)
  • Argon2i benchmarks with different memory/time cost combinations
  • Argon2id benchmarks (modern variant) with various parameters
  • Password verification performance testing
  • Graceful fallbacks for unavailable algorithms

Why this matters:

  • Helps to choose appropriate cost parameters for their use case
  • Provides insights into performance implications of different hashing strategies
  • Assists in capacity planning by showing real-world hashing performance
  • Demonstrates the performance trade-offs between security and speed

@sergix44
Copy link
Owner

Can you please move the new file to an "extra" directory and add some docs in the readme?
Since that as you said, bcrypt or argon hashes are constant time functions that are not changing across hardware config or php version (in theory), so doesn't make much sense use that as a benchmark comparison, and are also increasing significantly how long the run takes.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants