Thursday, 8 August 2013

PHP BCrypt output correct?

PHP BCrypt output correct?

new to stackoverflow :)
Searched for a long time but cant seem to find what im looking for so ill
just ask.
I just now started to use a bcrypt function ive found on some site about
security.
Ive never really worried about the output from this until our technician
at work said this to me.
The salt seems to always be in the front of every password.
Is this correct or have I made a major Boo Boo!? :)

The code i use is this:



// Check if bcrypt is available on the server
if (CRYPT_BLOWFISH != 1) {
throw new Exception("bcrypt stöds inte. Se http://php.net/crypt");
return;
}
// Check that rounds are within the allowed range
if ($rounds < 4)
$rounds = 4;
else if ($rounds > 12)
$rounds = 12;
// Create a prefix to tell the crypt that we want to use bcrypt
$salt_prefix = sprintf('$2a$%02d$', $rounds);
// Check if the salt contains invalid characters:
if (!preg_match('#^[A-Za-z0-9./]{22}$#', $salt)) {
// The salt is not bcrypt-safe. Redo to 22 characters (A-Za-z0-9. /)
$new_salt = base64_encode($salt);
if (strlen($new_salt) < 22)
$new_salt .= base64_encode(md5($salt));
$salt = substr($new_salt, 0, 22);
$salt = str_replace(array('+', '-'), '.', $salt);
$salt = str_replace(array('=', '_'), '/', $salt);
}
// hash the password with bcrypt
return crypt($password, $salt_prefix.$salt);
} // Examples : echo "Bcrypt: ". bcrypt('abc', 'QyrjMQfjgGIb4ymtdKQXIr',
12); ?>


This will output:

Bcrypt: $2a$12$QyrjMQfjgGIb4ymtdKQXIewDBqhA3eNppF8qOrMhidnEbzNvmHqhy

As you can see the salt is inside the password now "bold text":

Salt = QyrjMQfjgGIb4ymtdKQXIr
pass = $2a$12$QyrjMQfjgGIb4ymtdKQXIewDBqhA3eNppF8qOrMhidnEbzNvmHqhy

This seem to be the same every time regardless of salt.
Salt is always included except the last character??

No comments:

Post a Comment