note 107338 deleted from function.crypt by danbrown
| From: | danbrown@php.net | Date: | Thu, 10 May 2012 21:25:44 +0000 |
| Subject: | note 107338 deleted from function.crypt by danbrown | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-187885@lists.php.net to get a copy of this message | ||
Note Submitter: ircmaxell at php dot net
----
Harry at simans:
That's absolutely not necessary. Crypt will automatically peel off the salt for you (and
include it in the output). You can add a function to generate the salt for you, but the crypt
function works the same way your wrapper does:
<?php
function makeSalt() {
static $seed = "./ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
$algo = '$2a';
$strength = '$08';
$salt = '$';
for ($i = 0; $i < 22; $i++) {
$salt .= substr($seed, mt_rand(0, 63), 1);
}
return $algo . $strength . $salt;
}
function makeHash($password) {
return crypt($password, makeSalt());
}
function verifyHash($password, $hash) {
return $hash == crypt($password, $hash);
}
?>
Which then means that this relation will always hold:
<?php
true === verifyHash($password, makeHash($password));
?>
So there's no need to store the salt separately, since crypt() stores it inline for you...