aboutsummaryrefslogtreecommitdiff
path: root/ratatoeskr/sys/pwhash.php
diff options
context:
space:
mode:
authorLaria Carolin Chabowski <laria@laria.me>2020-09-25 23:09:31 +0200
committerLaria Carolin Chabowski <laria@laria.me>2020-09-25 23:09:31 +0200
commit5e347e4efaa81c2108256dc927208cd55dc10baa (patch)
treefccd9fea24e436ea2f3fa073475b2b665a4c31cf /ratatoeskr/sys/pwhash.php
parent854fef47192b45517d112e630fe2afa830432253 (diff)
downloadratatoeskr-cms-5e347e4efaa81c2108256dc927208cd55dc10baa.tar.gz
ratatoeskr-cms-5e347e4efaa81c2108256dc927208cd55dc10baa.tar.bz2
ratatoeskr-cms-5e347e4efaa81c2108256dc927208cd55dc10baa.zip
Use password_hash() and friends to hash and verify passwords
Previously I rolled my own password hashing function. While it at least used some sort of salt, it's still a terrible idea. The newly created class PasswordHash wraps the password_hash() family of functions but can also check the old password hash format (to distinguish them, the new password hashes are prefixed with a '!'). In PasswordHash::needsRehash we then always report an hash of the old format as being in need of a rehash. That way, these old hashes will be replaced the next time the user successfully logs in.
Diffstat (limited to 'ratatoeskr/sys/pwhash.php')
-rw-r--r--ratatoeskr/sys/pwhash.php76
1 files changed, 0 insertions, 76 deletions
diff --git a/ratatoeskr/sys/pwhash.php b/ratatoeskr/sys/pwhash.php
deleted file mode 100644
index f52ae03..0000000
--- a/ratatoeskr/sys/pwhash.php
+++ /dev/null
@@ -1,76 +0,0 @@
-<?php
-/*
- * File: ratatoeskr/sys/pwhash.php
- *
- * Hashing passwords
- *
- * License:
- * This file is part of Ratatöskr.
- * Ratatöskr is licensed unter the MIT / X11 License.
- * See "ratatoeskr/licenses/ratatoeskr" for more information.
- */
-
-/*
- * Class: PasswordHash
- * Contains static functions for password hashes.
- * Is just used as a namespace, can not be created.
- *
- * It should be fairly difficult to break these salted hashes via bruteforce attacks.
- */
-class PasswordHash
-{
- private function __construct()
- {
- } /* Prevent construction */
-
- private static $saltlen_min = 20;
- private static $saltlen_max = 30;
- private static $iterations_min = 200;
- private static $iterations_max = 1000;
-
- private static function hash($data, $salt, $iterations)
- {
- $hash = $data . $salt;
- for ($i = $iterations ;$i--;) {
- $hash = sha1($data . $hash . $salt, (bool) $i);
- }
- return $iterations . '$' . bin2hex($salt) . '$' . $hash;
- }
-
- /*
- * Function: create
- * Create a password hash string.
- *
- * Parameters:
- * $password - The password (or other data) to hash.
- *
- * Returns:
- * The salted hash as a string.
- */
- public static function create($password)
- {
- $salt = "";
- $saltlen = mt_rand(self::$saltlen_min, self::$saltlen_max);
- for ($i = 0; $i < $saltlen; $i++) {
- $salt .= chr(mt_rand(0, 255));
- }
- return self::hash($password, $salt, mt_rand(self::$iterations_min, self::$iterations_max));
- }
-
- /*
- * Function: validate
- * Validate a salted hash.
- *
- * Parameters:
- * $password - The password to test.
- * $pwhash - The hash to test against.
- *
- * Returns:
- * True, if $password was correct, False otherwise.
- */
- public static function validate($password, $pwhash)
- {
- list($iterations, $hexsalt) = explode('$', $pwhash);
- return self::hash($password, pack("H*", $hexsalt), $iterations) == $pwhash;
- }
-}