On 26.07.2024 at 15:13, Rowan Tommins [IMSoP] wrote:
> On Fri, 26 Jul 2024, at 12:58, Tim Düsterhus wrote:
>
>> CRC32 does not claim to be a cryptographically secure hash algorithm.
>> Its use case is completely different.
>
> As an inexperienced user looking at the PHP manual for hash() and hash_algos(), how would I
> know that? It's right there in the list, just after something called "adler32".
Well, you are supposed to also check the hash_hmac() documentation,
where a changelog entry for 7.2.0 states:
| Usage of non-cryptographic hash functions (adler32, crc32, crc32b,
| fnv132, fnv1a32, fnv164, fnv1a64, joaat) was disabled.
Or maybe we should fix <https://github.com/php/doc-en/issues/3616>.
Cheers,
Christoph