Bug #64688 [Fbk->NoF]: crypt doesn't truncate salt correctly for EXT_DES

Edit report at https://bugs.php.net/bug.php?id=64688&edit=1 ID: 64688 Updated by: php-bugs@lists.php.net Reported by: chaos-master at gmx dot de Summary: crypt doesn't truncate salt correctly for EXT_DES -Status: Feedback +Status: No Feedback Type: Bug Package: *Encryption and hash functions Operating System: GNU/Linux PHP Version: 5.3.24 Private report: N New Comment: No feedback was provided. The bug is being suspended because we assume that you are no longer experiencing the problem. If this is not the case and you are able to provide the information that was requested earlier, please do so and change the status of the bug back to "Re-Opened". Thank you. Previous Comments: ------------------------------------------------------------------------ [2015-09-07 23:48:13] cmb@php.net I can't reproduce the described behavior: <https://3v4l.org/MUY4n>. Could you please provide further details where it occurs? ------------------------------------------------------------------------ [2013-04-21 16:51:41] chaos-master at gmx dot de changed bug type: doc -> bug ------------------------------------------------------------------------ [2013-04-21 16:47:33] chaos-master at gmx dot de Description: ------------ --- From manual page: http://www.php.net/function.crypt#refsect1-function.crypt-examples --- The documentation for the crypt()-function asks to provide the complete hash as salt in order to verify a given hash. However if the given hash is an EXT_DES Hash this doesn't work correctly Test script: --------------- <?php // Correct behavior (here using SHA512) $hash = crypt('foobar', '$6$Rp.sVGo.zbHnQds.'); echo $hash."\n"; // $6$Rp.sVGo.zbHnQds.$I/mOIzdGE8g53MGbCe8gPcOdUMX.BiGz8Nx9HMa0UDKacGscGIAu.H75iG5U0d/niZk76y/LLHtHKZL9VdEZY0 echo crypt('foobar', $hash)."\n"; // $6$Rp.sVGo.zbHnQds.$I/mOIzdGE8g53MGbCe8gPcOdUMX.BiGz8Nx9HMa0UDKacGscGIAu.H75iG5U0d/niZk76y/LLHtHKZL9VdEZY0 // Inorrect behavior (EXT_DES) $hash = crypt('foobar', '_6C/.jjzc'); echo $hash."\n"; // _6C/.jjzcoAyXu0Z0XlM echo crypt('foobar', $hash)."\n"; // _6T7pAW9oacXQ // Workaround echo crypt('foobar', substr($hash,0,9))."\n"; // _6C/.jjzcoAyXu0Z0XlM ?> Expected result: ---------------- $6$Rp.sVGo.zbHnQds.$I/mOIzdGE8g53MGbCe8gPcOdUMX.BiGz8Nx9HMa0UDKacGscGIAu.H75iG5U0d/niZk76y/LLHtHKZL9VdEZY0 $6$Rp.sVGo.zbHnQds.$I/mOIzdGE8g53MGbCe8gPcOdUMX.BiGz8Nx9HMa0UDKacGscGIAu.H75iG5U0d/niZk76y/LLHtHKZL9VdEZY0 _6C/.jjzcoAyXu0Z0XlM _6C/.jjzcoAyXu0Z0XlM _6C/.jjzcoAyXu0Z0XlM Actual result: -------------- $6$Rp.sVGo.zbHnQds.$I/mOIzdGE8g53MGbCe8gPcOdUMX.BiGz8Nx9HMa0UDKacGscGIAu.H75iG5U0d/niZk76y/LLHtHKZL9VdEZY0 $6$Rp.sVGo.zbHnQds.$I/mOIzdGE8g53MGbCe8gPcOdUMX.BiGz8Nx9HMa0UDKacGscGIAu.H75iG5U0d/niZk76y/LLHtHKZL9VdEZY0 _6C/.jjzcoAyXu0Z0XlM _6T7pAW9oacXQ _6C/.jjzcoAyXu0Z0XlM ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=64688&edit=1