Bug #62488 [Opn->Csd]: Invalid bcrypt hash

Edit report at https://bugs.php.net/bug.php?id=62488&edit=1 ID: 62488 Updated by: cmb@php.net Reported by: smt837784 at yahoo dot com Summary: Invalid bcrypt hash -Status: Open +Status: Closed Type: Bug Package: *Encryption and hash functions Operating System: Fedora 16 (3.3.4-1.fc16.x86_64) PHP Version: 5.3.14 -Assigned To: +Assigned To: cmb Block user comment: N Private report: N New Comment: This issue is resolved as of PHP 5.5.0: <https://3v4l.org/u6MPZ>. Previous Comments: ------------------------------------------------------------------------ [2013-01-21 02:28:22] daniel at heath dot cc Allowing these '$' characters without reporting any errors is confusing; these hashes cannot be decoded by any standard-compliant implementation of bcrypt. ------------------------------------------------------------------------ [2012-07-06 03:06:17] smt837784 at yahoo dot com Description: ------------ If the salt is less than 128 bits (22 characters in base 64) it is padded with "$" instead of ".". Which is an invalid bcrypt hash. Test script: --------------- echo crypt('', '$2y$04$......................') . '<br>'; echo crypt('', '$2y$04$....') . '<br>'; echo crypt('', '$2y$04$....$$$$$$$$$$$$$$$$$.'); // keep backwards compatibility Expected result: ---------------- $2y$04$......................w74bL5gU7LSJClZClCa.Pkz14aTv/XO $2y$04$......................w74bL5gU7LSJClZClCa.Pkz14aTv/XO $2y$04$....$$$$$$$$$$$$$$$$$.w74bL5gU7LSJClZClCa.Pkz14aTv/XO Actual result: -------------- $2y$04$......................w74bL5gU7LSJClZClCa.Pkz14aTv/XO $2y$04$....$$$$$$$$$$$$$$$$$.w74bL5gU7LSJClZClCa.Pkz14aTv/XO $2y$04$....$$$$$$$$$$$$$$$$$.w74bL5gU7LSJClZClCa.Pkz14aTv/XO ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=62488&edit=1