Re: crypt(), password_hash(), and password_verify()

Found another, the crypt() documentation needs "password_verify() is" added to it: "password_hash() uses a strong hash, generates a strong salt, and applies proper rounds automatically. password_hash() is a simple crypt() wrapper and [password_verify() is] compatible with existing password hashes. Use of password_hash() is encouraged." > On 02/19/2022 7:47 PM steve@tobtu.com wrote: > > > Documentation for crypt() and password_verify() should be updated to say that password_verify() > supports hashes created with crypt() because I was actually unaware of this. password_hash() > documentation says: > "password_hash() is compatible with crypt(). Therefore, password hashes created by crypt() > can be used with password_hash()." > > Which doesn't make sense since password_hash() only creates hashes. Also crypt() > doesn't support Argon2 hashes. I believe this was suppose to be added to the password_verify() > documentation but ended up on the wrong page. > > > Also the crypt() documentation for CRYPT_EXT_DES says: > The "salt" is a 9-character string consisting of an underscore followed by 4 bytes of > iteration count and 4 bytes of salt. These are encoded as printable characters, 6 bits per > character, least significant character first. > > This should be: > The "salt" is a 9-character string consisting of an underscore followed by 4 > characters of iteration count and 4 characters of salt. Each of these 4 characters encode 24 bits, > least significant character first. > > See > https://en.wikipedia.org/wiki/Crypt_(C)#BSDi_extended_DES-based_scheme: > "BSDi extended the salt to 24 bits and made the number of rounds variable (up to 2^24-1)." > Huh that section had the same error and it's been like that since August 2012. Anyway I fixed > it there too.