Doc #61619 [Nab]: Bcrypt in crypt() fails for cost value less then 10

Edit report at https://bugs.php.net/bug.php?id=61619&edit=1 ID: 61619 User updated by: e dot zimuel at gmail dot com Reported by: e dot zimuel at gmail dot com Summary: Bcrypt in crypt() fails for cost value less then 10 Status: Not a bug Type: Documentation Problem Package: Documentation problem Operating System: linux PHP Version: 5.3.10 Block user comment: N Private report: N New Comment: Thanks for the clarification. My misunderstanding was about the term 'digit' as integer, that actually is a string of two digit. Previous Comments: ------------------------------------------------------------------------ [2012-04-07 19:38:46] frozenfire@php.net I understand how you were confused about this, but if you read carefully, it does say that the cost parameter is two digits. Using two digits works correctly for 04-31. Example: $password= '12345678'; $salt = '1234567890123456789012'; for($i=4;$i<=31;$i++) { $x = sprintf('%1$02d', $i); $hash = crypt($password,'$2a$'.$x.'$'.$salt); echo ( strlen($hash)<=13 ? "$x Fails: $hash \n" : "$x Ok: $hash\n"); } ------------------------------------------------------------------------ [2012-04-04 09:12:07] e dot zimuel at gmail dot com Description: ------------ The bcrypt algorithm in the crypt() function fails for cost values less than 10. In the documentation is written that the values to use are in the range 4-31, this range should be 10-31. --- From manual page: http://www.php.net/function.crypt#refsect1-function.crypt-description --- Test script: --------------- $password= '12345678'; $salt = '1234567890123456789012'; for($i=4;$i<=12;$i++) { $hash = crypt($password,'$2a$'.$i.'$'.$salt); echo ( strlen($hash)<=13 ? "Fails: $hash \n" : "Ok: $hash\n"); } Expected result: ---------------- Ok: $2a$4$123456789012345678901u... Ok: $2a$5$123456789012345678901u... Ok: $2a$6$123456789012345678901u... Ok: $2a$7$123456789012345678901u... Ok: $2a$8$123456789012345678901u... Ok: $2a$9$123456789012345678901u... Ok: $2a$10$123456789012345678901uOmjxspUyFLEdp6mxJQ4iRnbKlKw1aH6 Ok: $2a$11$123456789012345678901ubLT1mu4s43rkUv0UK6fLURb3WhhPi1. Ok: $2a$12$123456789012345678901uwZOx4Im8nWhwn3NpS/SBswvxBysXf5q Actual result: -------------- Fails: $2lH9Bbg1vo/g Fails: $2lH9Bbg1vo/g Fails: $2lH9Bbg1vo/g Fails: $2lH9Bbg1vo/g Fails: $2lH9Bbg1vo/g Fails: $2lH9Bbg1vo/g Ok: $2a$10$123456789012345678901uOmjxspUyFLEdp6mxJQ4iRnbKlKw1aH6 Ok: $2a$11$123456789012345678901ubLT1mu4s43rkUv0UK6fLURb3WhhPi1. Ok: $2a$12$123456789012345678901uwZOx4Im8nWhwn3NpS/SBswvxBysXf5q ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=61619&edit=1