crypt(), password_hash(), and password_verify()
| From: | steve at tobtu dot com | Date: | Sun, 20 Feb 2022 01:47:06 +0000 |
| Subject: | crypt(), password_hash(), and password_verify() | ||
| Groups: | php.doc | ||
| Request: | Send a blank email to phpdoc+get-969388073@lists.php.net to get a copy of this message | ||
Documentation for crypt() and password_verify() should be updated to say that password_verify()
supports hashes created with crypt() because I was actually unaware of this. password_hash()
documentation says:
"password_hash() is compatible with crypt(). Therefore, password hashes created by crypt() can
be used with password_hash()."
Which doesn't make sense since password_hash() only creates hashes. Also crypt() doesn't
support Argon2 hashes. I believe this was suppose to be added to the password_verify() documentation
but ended up on the wrong page.
Also the crypt() documentation for CRYPT_EXT_DES says:
The "salt" is a 9-character string consisting of an underscore followed by 4 bytes of
iteration count and 4 bytes of salt. These are encoded as printable characters, 6 bits per
character, least significant character first.
This should be:
The "salt" is a 9-character string consisting of an underscore followed by 4 characters of
iteration count and 4 characters of salt. Each of these 4 characters encode 24 bits, least
significant character first.
See https://en.wikipedia.org/wiki/Crypt_(C)#BSDi_extended_DES-based_scheme:
"BSDi extended the salt to 24 bits and made the number of rounds variable (up to 2^24-1)."
Huh that section had the same error and it's been like that since August 2012. Anyway I fixed
it there too.