什么是PHP手册中password_hash

Question

成本的选择是大量的实例使用password_hash 一些成本例如用来计算性价比不错

<?php 
/** 
* This code will benchmark your server to determine how high of a cost you can 
* afford. You want to set the highest cost that you can without slowing down 
* you server too much. 8-10 is a good baseline, and more is good if your servers 
* are fast enough. The code below aims for ≤ 50 milliseconds stretching time, 
* which is a good baseline for systems handling interactive logins. 
*/ 
$timeTarget = 0.05; // 50 milliseconds 

$cost = 8; 
do { 
$cost++; 
$start = microtime(true); 
password_hash("test", PASSWORD_BCRYPT, ["cost" => $cost]); 
$end = microtime(true); 
} while (($end - $start) < $timeTarget); 

echo "Appropriate Cost Found: " . $cost . "\n"; 
?> 

成本立场？

Answer 1

从wikipedia：

成本参数指定一个密钥扩展迭代计数作为 两个电源，其是输入到隐窝算法。

Answer 2

https://wildlyinaccurate.com/bcrypt-choosing-a-work-factor/

之所以密钥的建立相可以是潜在地昂贵的，因为它运行2 ^工作倍。由于密码散列通常与常用任务相关，例如将用户登录到系统中，因此在安全性和性能之间找到适当的平衡非常重要。使用高工作因子使得执行强力攻击非常困难，但是会给系统带来不必要的负担。