search

DomBlack / php-scrypt

A PHP wrapper fo the scrypt hashing algorithm
Other
209 stars 57 forks source link

Hash identifying? #42

Closed My1 closed 8 years ago

My1 commented 8 years ago

how can scrypt hashes be identified? for example bcrypt usually starts with $2a$ (or $2y$ in later PHP) which makes them easy to identify on sight for both humans and machines.

is there some "identifier" for scrypt?

DomBlack commented 8 years ago

There was a proposal for a crypt scheme here - https://gitorious.org/scrypt/scrypt-unix-crypt. It appears to be unavailable at the moment though.

Summary though is:

7 MCF:

The scrypt method requires three parameters in the SALT value: N, r, p, which are expressed like this: Nrrrrrppppp

Where N, r and p and encoded using crypt(3)'s traditional base-64 alphabet [./0-9A-Za-z].

  • N is specified as base-2 logarithm of scrypt's actual N value.
  • r and p are up to 30 bits, thus they only need 5 base-64 digits each. They are encoded in little-endian form (the first base-64 digit is the least significant). The PWD part is the password hash string base-64 encoded (again using crypt(3)'s traditional alphabet).

The encoded form for the default "pleaseletmein" with the salt "SodiumChloride" with N = 16384, r = 8, p = 1 is $7$C6..../....SodiumChloride$kBGj9fHznVYFQMEn/qDCfrDevf9YDtcDdKvEqHJLV8D

Last I checked though, it had not been accepted by the crypt team.

I never got around to implementing this digest format in this plugin, but have done it else where. The demo code provided doesn't include a prefix, but it would be easy enough to add one.