#48664 [NoF->Asn]: crypt truncating salt values

ID: 48664 Updated by: pajoye@php.net Reported By: patrickdk at patrickdk dot com -Status: No Feedback +Status: Assigned Bug Type: Strings related Operating System: linux 2.6.x PHP Version: 5.2.10 Assigned To: pajoye Previous Comments: ------------------------------------------------------------------------ [2009-07-03 01:00:00] php-bugs at lists dot php dot net No feedback was provided for this bug for over a week, so it is being suspended automatically. If you are able to provide the information that was originally requested, please do so and change the status of the bug back to "Open". ------------------------------------------------------------------------ [2009-06-25 21:12:00] pajoye@php.net Yes, it can be a solution. We can also simply implement the missing algo in php and always use them, for the users benefits (portability). ------------------------------------------------------------------------ [2009-06-25 03:26:18] patrickdk at patrickdk dot com What I would like to see is this: We can use the new php builtin crypt function for hashs it can understand, like des, md5, and blowfish (I think it does md5) For hashs it doesn't understand, by matching the the has type in the supplied salt, if it start with $ and follows a type unknown, pass it off to the system crypt function (or crypt_r). If one doesn't exist (windows) then it can just fail. Then it wouldn't matter if new crypt hashs come into being and php can't handle them internally, as long as the system libs can. ------------------------------------------------------------------------ [2009-06-25 02:16:13] patrickdk at patrickdk dot com Ok, I tried php-5.3.0RC4 on ubuntu 8.04 It didn't work at first, and I found out it's cause it didn't detect crypt_r, so php used it's internal routines, so that was to be expected. It seems configure doesn't test for crypt_r in libcrypt So I overrode that, and it worked fine (same results though). salt is truncated cause php only detects crypt_md5, and truncates salts to 12bytes. If I hack the salt_max then everything works as expected. same results using rhel5 ------------------------------------------------------------------------ [2009-06-24 18:48:36] pajoye@php.net Debian/Ubuntu should really stop to do stupid things with PHP. Which version do you use (of ubuntu)? And have you tried using 5.3.0RC4? If not, please try. ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at http://bugs.php.net/48664 -- Edit this bug report at http://bugs.php.net/?id=48664&edit=1