title: php sodium_crypto_pwhash_str_verify() fails
body: <p>I'm trying to figure out how to use the new <code>libsodium</code> features in php7.2, but for some reason I can't seem to get <code>sodium_crypto_pwhash_str_verify()</code> to work properly.</p>
  
  <p>I decided to actually use the given example in their documentation: <a href="https://paragonie.com/blog/2017/06/libsodium-quick-reference-quick-comparison-similar-functions-and-which-one-use#crypto-pwhash-sample-php" rel="nofollow noreferrer">https://paragonie.com/blog/2017/06/libsodium-quick-reference-quick-comparison-similar-functions-and-which-one-use#crypto-pwhash-sample-php</a></p>
  
  <p><strong>Sample code from libsodium themselves:</strong></p>
  
  <blockquote>
    <p>Note: I've contacted the author about the sample code and it has now
    been fixed! So the example below is outdated. (2018-05-30)</p>
  </blockquote>
  
  <p><em>(the only adjustment that I made is the <code>$passwort = "test"</code> and <code>echo</code>s)</em></p>
  
  <pre><code>&lt;?php
  $password = "test"; // by me
  
  /* This uses Argon2i with two numeric constants that correspond to
   * the number of passes (OPSLIMIT) and the amount of memory to use
   * (MEMLIMIT). A higher OPSLIMIT helps against CPU attacks, while a
   * higher MEMLIMIT helps against GPU attacks.
   */
  $storeInDatabase = sodium_crypto_pwhash_str(
      $password, 
      SODIUM_CRYPTO_PWHASH_OPSLIMIT_INTERACTIVE,
      SODIUM_CRYPTO_PWHASH_MEMLIMIT_INTERACTIVE
  );
  
  /* Once that's stored, you can just test against the hash like so: */
  if (sodium_crypto_pwhash_str_verify($password, $storeInDatabase)) {
      /* Logged in! */
      echo "works!"; // by me
  } else {
      /* Incorrect password. */
      echo "failed!"; // by me
  }
  </code></pre>
  
  <p>Since I am hashing and verifying with the same <code>$password</code> and <code>$storeInDatabase</code>, this should always print <code>"works!"</code>, but it doesn't.</p>
  
  <p>What am I doing wrong here? Sadly, php.net doesn't have any useful documentation for the <code>sodium</code> functions yet.</p>
  
  <p>For Reference:</p>
  
  <p><a href="http://php.net/manual/en/function.sodium-crypto-pwhash-str.php" rel="nofollow noreferrer">http://php.net/manual/en/function.sodium-crypto-pwhash-str.php</a></p>
  
  <p><a href="http://php.net/manual/en/function.sodium-crypto-pwhash-str-verify.php" rel="nofollow noreferrer">http://php.net/manual/en/function.sodium-crypto-pwhash-str-verify.php</a></p>