CODEWITHSUNDEEP
phpsecurityauthenticationbcrypt
Saul Tigh
Saul Tigh

Reputation: 177

Any reason not to use bcrypt on email addresses?

Login form I'm working on right now uses user email address and password to login. So I was thinking, is there any reason why I shouldn't want to use bcrypt on email addresses as:

$email_hash = password_hash($email, PASSWORD_DEFAULT);

I know it's intended for passwords, but so what? Should work on emails as well... If email is used to login, shouldn't it be hashed/salted just like the password? I know this isn't a standard practice, but never understood why.

I don't necessarily need to know user's email addresses. I mean, it's not like I'm gonna chat with them. Maybe when a user gets banned I should inform them by email, but why bother informing outlaws in the first place.

Upvotes: 2

Views: 1233

Answers (1)

Jonathan
Jonathan

Reputation: 5864

You need the email address to lookup the user record.

Typically you do something like this:

function create_account(email, password) {
    var pwhash = password_hash($password, PASSWORD_BCRYPT);
    // insert into users values ($email, $pwhash);
}

function login(email, password) {
    // select pwhash from users where email = $email;
    return password_verify($password, $pwhash); // true or false
}

password_hash($email) will always return a different value because bcrypt includes a salt in the hash.

From wikipedia:

For example, the [bcrypt hash] $2a$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy specifies a cost parameter of 10, indicating 210 key expansion rounds. The salt is N9qo8uLOickgx2ZMRZoMye and the resulting hash is IjZAgcfl7p92ldGxad68LJZdL17lhWy.

Or from PHP docs:

Note that password_hash() returns the algorithm, cost and salt as part of the returned hash. Therefore, all information that's needed to verify the hash is included in it. This allows the verify function to verify the hash without needing separate storage for the salt or algorithm information.

Upvotes: 4

Related Questions