note 107436 deleted from function.crypt by joey

Note Submitter: Sergio D L ---- ircmaxell at php dot net : "So there's no need to store the salt separately, since crypt() stores it inline for you..." I wouldn't recommend that. When you're using Blowfish algorithm with a 22 char long salt (less may return *0), the last character will most likely be stripped out the string. Like in this example: <?php $salt = '$2a$10$po8w4yriabndjhfq4toyta'; $pass = "will encrypt this"; echo "Salt:&nbsp;&nbsp;&nbsp; $salt <br /> Returns:&nbsp;&nbsp;&nbsp;" . crypt($pass, $salt); /* ---------------------- Will return: Salt: $2a$10$po8w4yriabndjhfq4toyta Returns: $2a$10$po8w4yriabndjhfq4toytO.Llhr8xTWXshX6imHrB9i.UNG6HDfBe ---------------------- */ ?> You can see the last "a" is stripped out (returning only $2a$10 + 21charSalt + 32charHash). Change the "a" to "m", and the hash will be succesfully changed to eYkPo.CiKcZJ..fIHeXVDutBs7JYAVNG Odd enough, change it to "b", and you'll get the same Hash from the first example. And will happen with other characters. This behavior has been documented in sites like stackoverflow when you ask "Why blowfish returns the same hash". PHP version: 5.3.6-13ubuntu3.3 So better keep the original salt you built. If you're constrained to the now obligatory 22 chars, most likely it will be truncated by crypt and you won't get the same hash if you try to reconstruct the hash with those 21 chars. Might be worse if your crypt doesn't accept less than 22 chars, you won't get any return value.