Req #76013 [Fbk->Opn]: Add simple hashes support in password_verify

Edit report at https://bugs.php.net/bug.php?id=76013&edit=1 ID: 76013 Updated by: cmb@php.net Reported by: anrdaemon at freemail dot ru Summary: Add simple hashes support in password_verify -Status: Feedback +Status: Open Type: Feature/Change Request Package: hash related PHP Version: Irrelevant -Assigned To: cmb +Assigned To: Block user comment: N Private report: N New Comment: Thanks for the clarification. While I am not supportive of this proposal (are there still apps which use unsalted SHA1 or even MD5 password hashes?), others may be. Previous Comments: ------------------------------------------------------------------------ [2018-02-27 12:49:57] anrdaemon at freemail dot ru md5 and sha1 hashes have well known lengths. I presume the length of the passed buffer is readily available, so you don't have to manually count bytes each time you want to know it. If no hashing signatures were found in a string, and the length is matching one of the two known values, try to use appropriate plain hashing function. This is not related to salted plain hashes, if anybody was using such a trick, it's up to them to sort the mess they have created. This is only limited to hashing functions natively provided by PHP (both md5 and sha1 availability predates PHP5). If anybody was using extensions, or database functions, this is out of scope of the proposal. This proposal does not include CRC32(the only other string hashing option available). A joke is too severe to seriously consider it as password hashing algo. ------------------------------------------------------------------------ [2018-02-27 11:12:17] cmb@php.net How is this supposed to work? The hashes supported by the password_*() functions clearly identify the hash algorithm (including any options), and also contain the salt that has been used to produce the hash. While it would be possible to guess the algorithm for "plain hashes" (I doubt that this would be a good idea, though), the salt would be unknown. ------------------------------------------------------------------------ [2018-02-26 17:45:40] anrdaemon at freemail dot ru Description: ------------ If only password_verify could support regular md5/sha1 hashes, it would make hell of a jumpstart for old applications migrating to new hashing schemes. Test script: --------------- <?php $pass = 'MyCoolPass'; $md5 = md5($pass); $sha1 = sha1($pass); $crypt = crypt($pass); $crypts = crypt($pass, (string)rand()); $hash = password_hash($pass, PASSWORD_DEFAULT); var_dump( password_get_info($md5), password_get_info($sha1), password_get_info($crypt), password_get_info($crypts), password_get_info($hash), password_verify($pass, $md5), password_needs_rehash($md5, PASSWORD_DEFAULT), password_verify($pass, $sha1), password_needs_rehash($sha1, PASSWORD_DEFAULT), password_verify($pass, $crypt), password_needs_rehash($crypt, PASSWORD_DEFAULT), password_verify($pass, $crypts), password_needs_rehash($crypts, PASSWORD_DEFAULT), password_verify($pass, $hash), password_needs_rehash($hash, PASSWORD_DEFAULT) ); Expected result: ---------------- bool(true) bool(true) bool(true) bool(true) bool(true) bool(true) bool(true) bool(true) bool(true) bool(false) Actual result: -------------- bool(false) bool(true) bool(false) bool(true) bool(true) bool(true) bool(true) bool(true) bool(true) bool(false) ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=76013&edit=1