Edit report at https://bugs.php.net/bug.php?id=76013&edit=1
ID: 76013
Updated by: cmb@php.net
Reported by: anrdaemon at freemail dot ru
Summary: Add simple hashes support in password_verify
-Status: Open
+Status: Feedback
Type: Feature/Change Request
Package: hash related
PHP Version: Irrelevant
-Assigned To:
+Assigned To: cmb
Block user comment: N
Private report: N
New Comment:
How is this supposed to work? The hashes supported by the
password_*() functions clearly identify the hash algorithm
(including any options), and also contain the salt that has been
used to produce the hash. While it would be possible to guess the
algorithm for "plain hashes" (I doubt that this would be a good
idea, though), the salt would be unknown.
Previous Comments:
------------------------------------------------------------------------
[2018-02-26 17:45:40] anrdaemon at freemail dot ru
Description:
------------
If only password_verify could support regular md5/sha1 hashes, it would make hell of a jumpstart for
old applications migrating to new hashing schemes.
Test script:
---------------
<?php
$pass = 'MyCoolPass';
$md5 = md5($pass);
$sha1 = sha1($pass);
$crypt = crypt($pass);
$crypts = crypt($pass, (string)rand());
$hash = password_hash($pass, PASSWORD_DEFAULT);
var_dump(
password_get_info($md5), password_get_info($sha1),
password_get_info($crypt), password_get_info($crypts),
password_get_info($hash),
password_verify($pass, $md5), password_needs_rehash($md5, PASSWORD_DEFAULT),
password_verify($pass, $sha1), password_needs_rehash($sha1, PASSWORD_DEFAULT),
password_verify($pass, $crypt), password_needs_rehash($crypt, PASSWORD_DEFAULT),
password_verify($pass, $crypts), password_needs_rehash($crypts, PASSWORD_DEFAULT),
password_verify($pass, $hash), password_needs_rehash($hash, PASSWORD_DEFAULT)
);
Expected result:
----------------
bool(true)
bool(true)
bool(true)
bool(true)
bool(true)
bool(true)
bool(true)
bool(true)
bool(true)
bool(false)
Actual result:
--------------
bool(false)
bool(true)
bool(false)
bool(true)
bool(true)
bool(true)
bool(true)
bool(true)
bool(true)
bool(false)
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=76013&edit=1