1

Before we begin: Yes I am aware that I should use PHP's password_hash function when actually storing passwords. This is a question about the internals of PHP's hashing system.

So I was messing around with PHP's crypt function the other day, and I noticed some odd behavior with bcrypt.

$password = "totallyagoodpassword";
$salt = "hereisa22charactersalt";

$parameter = '$2y$10$' . $salt;

echo $parameter . PHP_EOL;
echo crypt($password, $parameter);

According to PHP's manual, this code should hash "totallyagoodpassword" using bcrypt, salting it with "hereisa22charactersalt." The output of this hash should be the scheme ("$2y$10$"), followed by the 22 characters of the salt, then followed by 31 characters of hash. Therefore, I should expect "$2y$10$hereisa22charactersalt" and then 31 characters of random base64 characters.

So I run the code:

$2y$10$hereisa22charactersalt
$2y$10$hereisa22charactersalev7uylkfHc.RuyCP9EG4my7WwDMKGRvG

And I can't help but notice how the salt I passed into crypt and the salt that came out aren't the same; specifically, the very last character magically became an "e." After running this with different salts, I still get this same quirk where the last and only last character of the output hash is different.

I'm not a developer for PHP, so I'm sure there is some logic behind this behaviour. But I'm curious.

Kilo
  • 21
  • 1

1 Answers1

0

The docs do not state that the output will include the entire 22 bytes of salt. Also the example on the crypt documentation shows a final "$" on the salt.

crypt('rasmuslerdorf', '$2a$07$usesomesillystringforsalt$')

Producing:

$2a$07$usesomesillystringfore2uDLvp1Ii2e./U9C8sBjqp8I90dH6hi

zaph
  • 111,848
  • 21
  • 189
  • 228
  • Most of the research I've done on bcrypt seem to indicate that the salt is 128 bits, which when encoded in base64 (ignoring padding), make up 22 characters. It doesn't really make sense to me that PHP would require 22 characters and then not use all of them. Also I tried with and without the final "`$`" and it didn't seem to make any difference. – Kilo Jul 21 '16 at 17:58