What about password_hash () in PHP?

Question

I read all the forums and tutorials about this password_hash(), which seems to be good for password protection.

But now I want to know whether it is better to create my own salt and hash for a function like

$options = [
    'cost' => 11,
    'salt' => mcrypt_create_iv(22, MCRYPT_DEV_URANDOM),
];
password_hash($password, PASSWORD_BCRYPT, $options);

Or just let the function do this:

password_hash($password, PASSWORD_DEFAULT);

There seems to be a lot of discussion about whether it is good or bad to use your salt.

Can someone explain why its bad (or not) to use your salt?

Answer 1

Because if you do not create your own salt, it will automatically create a safe salt for you.

From the documentation:

Attention

, . , .

, , ... , !

Answer 2

- .
, .
, .
.
rng . https://crypto.stackexchange.com/questions/1776/can-you-help-me-understand-what-a-cryptographic-salt-is

, rng, .
, , .

:

, , .

, . 60- -. password_verify() -. .