Add Yescrypt support to crypt() and password API

[nielsdos]

Implements #12911
Might need an RFC to decide on some non-trivial details

[TimWolla]

Some remarks, didn't look at everything and especially not in detail.

[TimWolla]

We probably want to reuse the existing SHA-256 implementation (for SHA-NI support).

[nielsdos]

I'll try; it has some extra stuff here like PBKDF2 etc, but the main loop can invoke the existing code probably.

[TimWolla]

Based on the license comment, this is the SHA-256 implementation from libcperciva, thus it's the same author as the SHA-NI implementation. The API should be compatible.

As for PBKDF2, PHP necessarily also contains an existing implementation of that, but I didn't check if the API matches.

[TimWolla]

Did another pass, looking a bit more in detail. It might make sense to loop in Solar Designer for him to verify if this integration is any good. From what I have seen he was somewhat involved in PHP before.

[TimWolla]

For visibility: TODO.

[TimWolla]

Is this something that would make sense to upstream?

[nielsdos]

The question is if the split will be kept.

There is the weird limitation now that you can't pass NUL bytes into the yescrypt password_hash() implementation. This happens because under the hood this uses crypt(), and when system crypt() is used instead of PHP crypt() it cannot deal with the NUL byte. To be consistent with system crypt I implemented rejecting NUL bytes. However, if we always make use of bundled yescrypt instead of relaying to system crypt's yescrypt, then we no longer have the NUL byte limitation; and then we also don't need to split the yescrypt code in a common and config part.
This would need to be discussed on the ML though.

[rjd22]

@nielsdos thank you for your work! This would be incredibly useful for control panel projects like HestiaCP and ISPConfig that for now have to hack their way around this.

Is there any way I can help out get this in php-src?

[remicollet]

@rjd22 notice that yescript hash is available when using system libxcrypt

$ php -n -r 'var_dump(crypt("test", "\$y\$j9T\$salt"));'
string(55) "$y$j9T$salt$a9CZafQyDF042zUCgPAhoF7Zd5phBweZqIIw6SMCTh."

And for password_hashing, using the xpass extension (libxcrypt bindings) without having to bundle new algo in PHP.

[bukka]

I really don't like more deps for standard extension. I think the whole crypt stuff should move to the separate extension. See #17093 for more context.