title: Is PHP's password_hash FIPS compliant?
body: <p>I believe <code>hash('sha256', $pw)</code> is FIPS compliant, but I know for certain that an attack vector is possible with using that function. Also, there is no salt (so I would have to encounter that implementation and I would rather not).  Is <code>password_hash</code>/<code>password_verify</code> FIPS compliant?</p>