note 114060 added to function.crypt

As I understand it, blowfish is generally seen a secure hashing algorithm, even for enterprise use (correct me if I'm wrong). Because of this, I created functions to create and check secure password hashes using this algorithm, and using the (also deemed cryptographically secure) openssl_random_pseudo_bytes function to generate the salt. <?php /* * Generate a secure hash for a given password. The cost is passed * to the blowfish algorithm. Check the PHP manual page for crypt to * find more information about this setting. */ function generate_hash($password, $cost=11){ /* To generate the salt, first generate enough random bytes. Because * base64 returns one character for each 6 bits, the we should generate * at least 22*6/8=16.5 bytes, so we generate 17. Then we get the first * 22 base64 characters */ $salt=substr(base64_encode(openssl_random_pseudo_bytes(17)),0,22); /* As blowfish takes a salt with the alphabet ./A-Za-z0-9 we have to * replace any '+' in the base64 string with '.'. We don't have to do * anything about the '=', as this only occurs when the b64 string is * padded, which is always after the first 22 characters. */ $salt=str_replace("+",".",$salt); /* Next, create a string that will be passed to crypt, containing all * of the settings, separated by dollar signs */ $param='$'.implode('$',array( "2y", //select the most secure version of blowfish (>=PHP 5.3.7) str_pad($cost,2,"0",STR_PAD_LEFT), //add the cost in two digits $salt //add the salt )); //now do the actual hashing return crypt($password,$param); } /* * Check the password against a hash generated by the generate_hash * function. */ function validate_pw($password, $hash){ /* Regenerating the with an available hash as the options parameter should * produce the same hash if the same password is passed. */ return crypt($password, $hash)==$hash; } ?> ---- Server IP: 192.41.45.150 Probable Submitter: 82.72.167.141 ---- Manual Page -- http://php.net/manual/en/function.crypt.php Edit -- https://master.php.net/note/edit/114060 Del: integrated -- https://master.php.net/note/delete/114060/integrated Del: useless -- https://master.php.net/note/delete/114060/useless Del: bad code -- https://master.php.net/note/delete/114060/bad+code Del: spam -- https://master.php.net/note/delete/114060/spam Del: non-english -- https://master.php.net/note/delete/114060/non-english Del: in docs -- https://master.php.net/note/delete/114060/in+docs Del: other reasons-- https://master.php.net/note/delete/114060 Reject -- https://master.php.net/note/reject/114060 Search -- https://master.php.net/manage/user-notes.php