As nobody would store plain password in a database, I’d like to write a short memo on how to encrypt passwords to be safely store them in our databases.
The first concept is hashing. In brief we use a function that takes a string as input (i.e. our plain text password) and produces an output that is different for each input string, but without the possibility to reverse the process. An once popular hashing algorithm was MD5, that is now believed to be not enough secure. Better alternatives include SHA-2 and Blowfish. In PHP we have this function to hash:
$hashedString = hash('sha1', $inputString);
The second concept is salting. Given that is almost impossible to guess the password given its hash, its possible to pre-compute million of hashes and use this database to predict the hidden password. This approach is referred to as rainbow tables. To avoid this the trick is to encrypt (hash) the string with some further text. This is salting.
The simplest form of salting is to encrypt a string like ‘this is the salt for a {$string}’, but if the salt is stored somewhere it is also possible to find it, and moreover if a single user uses a weak password and somehow the hacker cracks it, he will also able to use the same salt for any other password. In PHP we use the hash() function only for to check integrity of contenct, not to crypt passwords, as we have a dedicated one:
$hashedPassword = crypt($password, $salt);
The salt parameter is slightly more complex than a bunch of chars though…
How to salt passwords with PHP
The crypt functions require a form of salt that includes a format string, indicating both the algorithm (I use 2y for Blowfish) and the cost (higher=stronger) of the process:
$password = 'myPassword';
$hash_format = "$2y$10$"; // 2y=blowfish; 10=cost of algorithm
$salt = "ThisIsMyLong1234567890Salt"; // has to be > 22 chars
echo 'Salt size: ' : strlen($salt);
$format_and_salt = $hash_format. $salt;
$hash = crypt($password, $format_and_salt);
Given that the “salt” contains the format as well, we can compare hashes like this:
if (hash_equals($hashed_password, crypt($user_input, $hashed_password))) {
echo "Password verified!";
}
