Bug #66293 [Opn->Fbk]: Password Hashing extension returns incorrect hashes for binary salts

Edit report at https://bugs.php.net/bug.php?id=66293&edit=1 ID: 66293 Updated by: ab@php.net Reported by: jan at zahlen-kern dot de Summary: Password Hashing extension returns incorrect hashes for binary salts -Status: Open +Status: Feedback Type: Bug Package: *Encryption and hash functions Operating System: Windows 7 PHP Version: 5.5Git-2013-12-13 (snap) Block user comment: N Private report: N New Comment: I think it's not correct using a nullbyted string as a salt. What's the result with some alnum salt string? Previous Comments: ------------------------------------------------------------------------ [2013-12-14 01:05:20] jan at zahlen-kern dot de Description: ------------ The password_hash() function accepts raw salt strings through the $options parameter, but it fails to encode them correctly. As a result, the hash is different than it would be with common bcrypt. This is caused by an incorrect encoding procedure: The function applies standard Base64, removes the padding and replaces "+" with ".". This does yield the right alphabet, but in the Base64 variant used by bcrypt, the digits have different values: Common Base64 is ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/ bcrypt Base 64 is ./ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789 So the function effectively adds 2 modulo 64 to every salt byte. The last salt digit in the resulting hash is correct, though, because the current bcrypt implementation internally fixes it. Test script: --------------- <?php $salt = str_repeat("\x00", 22); echo password_hash('foo', PASSWORD_BCRYPT, array('salt' => $salt)); Expected result: ---------------- The resulting hash should be "$2y$10$......................0li5vIK0lccG/IXHAOP2wBncDW/oa2u" Actual result: -------------- Instead, it is "$2y$10$AAAAAAAAAAAAAAAAAAAAA.A6.6PO3Wv4OxvTWdUxMVpdLT2d5g/FG" ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=66293&edit=1