search

ircmaxell / password_compat

Compatibility with the password_* functions that ship with PHP 5.5
MIT License
2.15k stars 421 forks source link

Hashes generated by PASSWORD_BCRYPT fail to verify in not-PHP #73

Closed ghost closed 9 years ago

ghost commented 9 years ago

I have tried generating and verifying hashes using the example code for this library provided in its README, and they fail to verify in node.js's bcrypt module, python's bcrypt module, and ruby's bcrypt module. These other three generate hashes compatible with one another, with the PHP bcrypt implementation being the odd one out. I'm not a cryptographer so I'm not sure where to go about looking for the problem. Wish I could provide more info; if some test cases would help, I'd be glad to provide them.

ghost commented 9 years ago

I did some experimenting and it looks like these libraries all assume the 2a hash format. I modified the library to append that NULL byte and output hashes in the 2a format and now they verify as expected.

ircmaxell commented 9 years ago

The correct fix would be to have the other library's modules add support for the standard 2y prefix (which is included in the reference specification and libcrypt).