Welcome to OGeek Q&A Community for programmer and developer-Open, Learning and Share
Welcome To Ask or Share your Answers For Others

Categories

0 votes
368 views
in Technique[技术] by (71.8m points)

php - hash() vs. crypt() function comparison

I'm currently implementing a login system. I want to store the password and the salt in a database. Now I found out that there is a hash() and a crypt() function which seems to do the same (valid for SHA512).

hash() is newer and seems to support more hashing alogrithms than crypt(). Or there any other differences I should know/care about?

Edit:

function generatePasswordHash($password){
    $salt = base64_encode(mcrypt_create_iv(8));
    $calculatedPasswordHash = crypt($password, '$1$' . $salt . '$');

    return $calculatedPasswordHash;
}

The result looks like $1$Qh6ByGJ9$zLn3yq62egvmc9D7SzA2u.

Here my password checking function:

function checkLoginData($username, $password){
    global $db;

    $sql = "SELECT * FROM users WHERE username = :username";
    $result = $db->ExecuteQuery($sql, array("username"=>$username));

    if(!empty($result)){
        $result = $result[0];
        $savedPasswordHash = $result['password'];
        $splitted = explode("$", $savedPasswordHash);
        $salt = $splitted[2];
        $calculatedPasswordHash = crypt($password, '$1$' . $salt . '$');

        if($savedPasswordHash === $calculatedPasswordHash){
            return true;
        }
    }

    return false;
}
See Question&Answers more detail:os

与恶龙缠斗过久,自身亦成为恶龙;凝视深渊过久,深渊将回以凝视…
Welcome To Ask or Share your Answers For Others

1 Reply

0 votes
by (71.8m points)

Use hash for hashing, for example in integrity checks. It directly uses the specified hashing algorithm.

crypt is a special purpose function. It's used for password hashing and key derivation. You'll need to pass in a salt, which indirectly determines the hashing scheme used. Even if you choose CRYPT_SHA512 this isn't plain SHA512. It's a key derivation function that uses SHA512 as building block. In particular such a scheme is deliberately slow(hider brute-force attacks) and combines salt and password in a secure way.

For password hashing in a log system, crypt is clearly the right choice.


与恶龙缠斗过久,自身亦成为恶龙;凝视深渊过久,深渊将回以凝视…
OGeek|极客中国-欢迎来到极客的世界,一个免费开放的程序员编程交流平台!开放,进步,分享!让技术改变生活,让极客改变未来! Welcome to OGeek Q&A Community for programmer and developer-Open, Learning and Share
Click Here to Ask a Question

...