CODEWITHSUNDEEP
phppassword-encryption
dbconfession
dbconfession

Reputation: 1199

Can someone clarify how the PHP function crypt() works?

From my understanding crypt(string, salt), takes the salt, tacks it onto the front of the encrypted version of the string parameter.

$pw = "secret";
$format_and_salt = $2y$10$MWRmZTkwMTc5ZGJjZDI1NT;
$hash = crypt($pw, $format_and_salt);

$hash gets stored to the database column hashed_password as $2y$10$MWRmZTkwMTc5ZGJjZDI1NOfGsQUgIu7ezETpe.uHjGqbmdrw2.vqm

or broken down:

first part is $format_and_salt: $2y$10$MWRmZTkwMTc5ZGJjZDI1N (sans the 'T')

+

second part is the encrypted $pw: OfGsQUgIu7ezETpe.uHjGqbmdrw2.vqm

If I then use crypt again to validate a password that a user submits to $_POST against the stored hashed_password in the database, the output for both cases doesn't seem to reflect the logic I described above. So I'm missing something.

So then:

$existing_hash = $admin['hashed_password'] ($admin being an array ultimately derived from a query).

and

crypt($pw, $existing_hash) returns $2y$10$MWRmZTkwMTc5ZGJjZDI1NOfGsQUgIu7ezETpe.uHjGqbmdrw2.vqm

which is identical to $hash above. This works to validate or invalidate the users submission to $_POST, but as mentioned, if I follow the logic for the first crypt() above, I would expect:

first part is $existing_hash: $2y$10$MWRmZTkwMTc5ZGJjZDI1NOfGsQUgIu7ezETpe.uHjGqbmdrw2.vqm

+

second part is the encrypted $pw: OfGsQUgIu7ezETpe.uHjGqbmdrw2.vqm

which I'd expect to combine as: $2y$10$MWRmZTkwMTc5ZGJjZDI1NOfGsQUgIu7ezETpe.uHjGqbmdrw2.vqmOfGsQUgIu7ezETpe.uHjGqbmdrw2.vqm

Can someone explain why the original crypt and the crypt just above that was used to validate the first one both have the same output? Thanks in advance.

Upvotes: 0

Views: 487

Answers (1)

mwotton
mwotton

Reputation: 2200

You're using Blowfish encryption - only the first 22 characters of the salt are used. This is one of the benefits of using blowfish.

From the PHP manual:

Blowfish hashing with a salt as follows: "$2a$", "$2x$" or "$2y$", a two digit cost parameter, "$", and 22 characters from the alphabet "./0-9A-Za-z".

This means that the salt from $existing_hash ends up being $2y$10$MWRmZTkwMTc5ZGJjZDI1N - exactly the same as previously.

Upvotes: 2

Related Questions