PHP 8.0 < 8.1 -- real slow due to XChaCha20 polyfill about halite

[paragonie-security]

We do have plans to add the internal counter to PHP 8.2, but that obviously won't land immediately.

[rotdrop]

I do not know what you mean by "internal counter". The problem I am describing is that in the default configuration with PHP 8.zero the PHP poly-fill is used. This is ok when you encrypt small chunks of data, but renders Halite actually close to unusable for large amounts of data. PHP 8.zero is not dead, is it? Halite really shows extremely poor performance with PHP 8.0.

[paragonie-security]

Oh, I misunderstood. I'll look into the problem. It should be using the standard library function by default.

[rotdrop]

Sorry, it can't use the standard library function because the version of the bundled libsodium (with PHP 8.zero) does not supply this function. Hence it has to use the poly-fill. As written in my first comment, in order to get the required sodium_crypto_stream_xchacha20_xor function you have to install a custom libsodium from its github repo (which implies that on some distros you have also to recompile PHP as it already comes with the "stable" version of libsodium compiled in.

[paragonie-security]

Sorry, it can't use the standard library function because the version of the bundled libsodium (with PHP 8.zero) does not supply this function.

The easiest solution then is to upgrade to PHP 8.1, since PHP 8.0 lacks this function built-in.

[rotdrop]

This is not an easy solution if parts of your project do not yet fully support PHP 8.0.

AND: you advertise your Halite to be usable with PHP 8.0: In your README.md I find:

Halite 5.0 and newer | 8.0.0 | 1.0.18 | N/A (standard) | Active

However, the usability of Halite 5 with PHP 8.0 is somewhat limited due to above mentioned performance problems.

Should not this be documented at a prominent position in README.md?

[paragonie-security]

No. We'll drop PHP 8.0 support if that makes it easier.

[paragonie-security]

https://github.com/paragonie/halite/releases/tag/v5.1.0