Bug #66293 [NEW]: Password Hashing extension returns incorrect hashes for binary salts

From: jan at zahlen-kern dot de Operating system: Windows 7 PHP version: 5.5Git-2013-12-13 (snap) Package: *Encryption and hash functions Bug Type: Bug Bug description:Password Hashing extension returns incorrect hashes for binary salts Description: ------------ The password_hash() function accepts raw salt strings through the $options parameter, but it fails to encode them correctly. As a result, the hash is different than it would be with common bcrypt. This is caused by an incorrect encoding procedure: The function applies standard Base64, removes the padding and replaces "+" with ".". This does yield the right alphabet, but in the Base64 variant used by bcrypt, the digits have different values: Common Base64 is ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/ bcrypt Base 64 is ./ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789 So the function effectively adds 2 modulo 64 to every salt byte. The last salt digit in the resulting hash is correct, though, because the current bcrypt implementation internally fixes it. Test script: --------------- <?php $salt = str_repeat("\x00", 22); echo password_hash('foo', PASSWORD_BCRYPT, array('salt' => $salt)); Expected result: ---------------- The resulting hash should be "$2y$10$......................0li5vIK0lccG/IXHAOP2wBncDW/oa2u" Actual result: -------------- Instead, it is "$2y$10$AAAAAAAAAAAAAAAAAAAAA.A6.6PO3Wv4OxvTWdUxMVpdLT2d5g/FG" -- Edit bug report at https://bugs.php.net/bug.php?id=66293&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=66293&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=66293&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=66293&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=66293&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=66293&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=66293&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=66293&r=needscript Try newer version: https://bugs.php.net/fix.php?id=66293&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=66293&r=support Expected behavior: https://bugs.php.net/fix.php?id=66293&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=66293&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=66293&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=66293&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=66293&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=66293&r=dst IIS Stability: https://bugs.php.net/fix.php?id=66293&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=66293&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=66293&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=66293&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=66293&r=mysqlcfg