4

First, I see that to use CRYPT_BLOWFISH, i need to use a 16 char salt starting with $2a$. However, the php.net documentation for crypt() says that some systems don't support CRYPT_BLOWFISH. How often is that the case?

Next, from their example on the docs, I see I use crypt() as follows:

<?php
$password = crypt('mypassword'); // let the salt be automatically generated

/* You should pass the entire results of crypt() as the salt for comparing a
   password, to avoid problems when different hashing algorithms are used. (As
   it says above, standard DES-based password hashing uses a 2-character salt,
   but MD5-based hashing uses 12.) */
if (crypt($user_input, $password) == $password) {
   echo "Password verified!";
}
?>

In order to use CRYPT_BLOWFISH, would the only thing I need to modify be the first line to make it like so;

crypt('mypassword', '$2a$07$usesomesillystringforsalt$')

and then the rest of the lines are fine as is?

Tony Stark
  • 24,588
  • 41
  • 96
  • 113

1 Answers1

5

For PHP before 5.3.0 crypt() used the lib supplied by the OS. If you are using an earlier version, then you'd need to check your OS documentation to see if it is supported (check the value of the CRYPT_BLOWFISH constant) - if not then the algorithm is implemented within the mcrypt() extension for PHP.

The example you've quoted from the docs doesn't seem to make much sense:

  $stored_password=fetch_password($user);

  if (crypt($_REQUEST['password'],$stored_password)===$stored_password) {
      // note that crypt automatically extracts the salt and alogrithm type
      // from $stored_password
      ....

You only need to specify the prefix ($2a$) when creating the password.

HTH

C.

symcbean
  • 47,736
  • 6
  • 59
  • 94
  • yeah but the only question i have left is: when i create the password, i use crypt('mypassword', '$2a$07$usesomesillystringforsalt$'), right? where my salt actually is a randomly generated 16 char string? – Tony Stark Feb 10 '10 at 11:23
  • I was getting a *0 running CRYPT_BLOWFISH with the hash $2y$10$, on PHP 8.0.8. I had to change PHP version to 7.4.21 (mamp) to get it to work. – Labanino Jul 28 '22 at 14:24
  • Its 2022 now. You shouldn't be using PHP 5.3 – symcbean Jul 31 '22 at 20:07