PHP crypt not matching correctly

Question

I'm trying to use PHP crypt() to create a basic password hashing/validating scheme. I'm unable to upgrade to PHP 5.5.0 right now, so I can't use password_hash() and password_verify().

My code is as follows:

function myinit_salt()
  {
    $options = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789./';

    for ($i = 0; $i <= 20; $i ++) {
      $options = str_shuffle ( $options );
      $salt .= $options [rand ( 0, 63 )];
    }

    return $salt;
  }

... (encrypting user-provided password upon registration) ...

$salt = myinit_salt();
$blowfish = '$2a$10$';
$enc_pw = crypt($userinput['password'], $blowfish . $salt);

... (store encrypted password in database) ...

... (validating stored password against user-provided password upon login attempt) ...

function verify_password($input_password, $db_password)
  {
    if ($input_password) {
      if (crypt($input_password, $db_password) == $db_password) {
        //authenticated
        return true;
      } else return false;
    } else return false;
  }

This has been returning false even if the user-provided passwords match. So I had verify_password() spit out the values it was using, and this is what was given:

user-provided password ($input_password) = abcxyz123

$db_password = $2a$10$y/WXEmlCb6392Wpf8FMpq.FuwwnaSU51x/xPdFYlTl5y6Bsn51Nzi

verify_password() crypt hash = $2a$10$y/WXEmlCb6392Wpf8FMpq.s8Y6lrJGDMOAJ4d8GffQUEiAWKsEyqS

So it looks like the salt matches, but the password hash doesn't match for some reason.

Can anyone shed some light? Thanks.

sectus sectus · Accepted Answer · 2014-10-01T01:41:03

You have two errors in your myinit_salt

function myinit_salt()
  {
    $options = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789./';
    $salt = ''; // without it notice would be raised
                     // v
    for ($i = 0; $i <= 21; $i ++) {             // <--- length of salt should be 22
                     // ^ 
      $options = str_shuffle ( $options );
      $salt .= $options [rand ( 0, 63 )];
    }

    return $salt;
  }

http://php.net/manual/en/function.crypt.php

P.S. Why do not use password php extension?

P.S.S. Do not create your own salt generation function. str_shuffle - is not secure for crypt functions. mt_rand too. It's better to use password extension where salt generation already implemented.

PHP crypt not matching correctly

2 Answers