#30316 [NEW]: Docs are wrong: multiple random salts supplied automatically

From: drachma60 at ml1 dot net Operating system: FreeBSD PHP version: 4.3.8 PHP Bug Type: Documentation problem Bug description: Docs are wrong: multiple random salts supplied automatically Description: ------------ http://us2.php.net/manual/en/function.crypt.php says: "If you are using the supplied salt, you should be aware that the salt is generated once. If you are calling this function recursively, this may impact both appearance and security." However, this does NOT seem to be the case, at least NOT on FreeBSD where crypt uses md5 by default. (Aside: Also, how would I call crypt "recursively"? "repeatedly" I can understand. But not "recursively", as crypt is not calling itself, nor can I (via PHP code) rewrite crypt to call itself.) Thanks! P.S. It looks like the documentation may have been correct before "bug" 8080 was fixed in December of 2000. Reproduce code: --------------- <?php for ($i = 0; $i < 10; $i++) { print crypt ("password"). "\n"; } ?> Expected result: ---------------- $1$salt$qJH7.N4xYta3aEG/dfqo/0 $1$salt$qJH7.N4xYta3aEG/dfqo/0 $1$salt$qJH7.N4xYta3aEG/dfqo/0 $1$salt$qJH7.N4xYta3aEG/dfqo/0 $1$salt$qJH7.N4xYta3aEG/dfqo/0 $1$salt$qJH7.N4xYta3aEG/dfqo/0 $1$salt$qJH7.N4xYta3aEG/dfqo/0 $1$salt$qJH7.N4xYta3aEG/dfqo/0 $1$salt$qJH7.N4xYta3aEG/dfqo/0 $1$salt$qJH7.N4xYta3aEG/dfqo/0 (Summary: I would expect all the salts to be the same, as per the documentation.) Actual result: -------------- $1$49EUp1Z7$o9UbbesjLIgng.AMtBhuC0 $1$ppH4o1pX$LWrm5Lk6RIxVdNnR2ow741 $1$PEKufg9F$.qqFw6E2IlueP08IV2MQa0 $1$9agtuCbw$DuMMRD7ybYuB5OBmlw87E/ $1$uzXF0rxF$3V8.0dzVaxVSEh6OgoFtF0 $1$MGg.lgdp$QGmQ68mkdiDDnIDRoAPa20 $1$ZDIvcKNU$1tpYj4x63Py6NKQlvWCD21 $1$rGzlQCSP$M8mRQH4VlNU2cDfb8Y6ru. $1$dKYZm7GZ$fQB58ZSFxm60e7Vovtma/. $1$tyR3/3kx$uw14iqFovhETlgWfdicro0 (Summary: As you can see, the salts are different.) -- Edit bug report at http://bugs.php.net/?id=30316&edit=1 -- Try a CVS snapshot (php4): http://bugs.php.net/fix.php?id=30316&r=trysnapshot4 Try a CVS snapshot (php5.0): http://bugs.php.net/fix.php?id=30316&r=trysnapshot50 Try a CVS snapshot (php5.1): http://bugs.php.net/fix.php?id=30316&r=trysnapshot51 Fixed in CVS: http://bugs.php.net/fix.php?id=30316&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=30316&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=30316&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=30316&r=needscript Try newer version: http://bugs.php.net/fix.php?id=30316&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=30316&r=support Expected behavior: http://bugs.php.net/fix.php?id=30316&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=30316&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=30316&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=30316&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=30316&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=30316&r=dst IIS Stability: http://bugs.php.net/fix.php?id=30316&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=30316&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=30316&r=float MySQL Configuration Error: http://bugs.php.net/fix.php?id=30316&r=mysqlcfg