Use password_hash() and friends to hash and verify passwords

Previously I rolled my own password hashing function. While it at least
used some sort of salt, it's still a terrible idea.

The newly created class PasswordHash wraps the password_hash() family of
functions but can also check the old password hash format (to distinguish
them, the new password hashes are prefixed with a '!'). In
PasswordHash::needsRehash we then always report an hash of the old format
as being in need of a rehash. That way, these old hashes will be replaced
the next time the user successfully logs in.

1 files changed, 0 insertions, 76 deletions

diff --git a/ratatoeskr/sys/pwhash.php b/ratatoeskr/sys/pwhash.php
deleted file mode 100644
index f52ae03..0000000
--- a/ratatoeskr/sys/pwhash.php
+++ /dev/null
@@ -1,76 +0,0 @@
-<?php
-/*
- * File: ratatoeskr/sys/pwhash.php
- *
- * Hashing passwords
- *
- * License:
- * This file is part of Ratatöskr.
- * Ratatöskr is licensed unter the MIT / X11 License.
- * See "ratatoeskr/licenses/ratatoeskr" for more information.
- */
-
-/*
- * Class: PasswordHash
- * Contains static functions for password hashes.
- * Is just used as a namespace, can not be created.
- *
- * It should be fairly difficult to break these salted hashes via bruteforce attacks.
- */
-class PasswordHash
-{
-    private function __construct()
-    {
-    } /* Prevent construction */
-
-    private static $saltlen_min = 20;
-    private static $saltlen_max = 30;
-    private static $iterations_min = 200;
-    private static $iterations_max = 1000;
-
-    private static function hash($data, $salt, $iterations)
-    {
-        $hash = $data . $salt;
-        for ($i = $iterations ;$i--;) {
-            $hash = sha1($data . $hash . $salt, (bool) $i);
-        }
-        return $iterations . '$' . bin2hex($salt) . '$' . $hash;
-    }
-
-    /*
-     * Function: create
-     * Create a password hash string.
-     *
-     * Parameters:
-     *  $password - The password (or other data) to hash.
-     *
-     * Returns:
-     *  The salted hash as a string.
-     */
-    public static function create($password)
-    {
-        $salt = "";
-        $saltlen = mt_rand(self::$saltlen_min, self::$saltlen_max);
-        for ($i = 0; $i < $saltlen; $i++) {
-            $salt .= chr(mt_rand(0, 255));
-        }
-        return self::hash($password, $salt, mt_rand(self::$iterations_min, self::$iterations_max));
-    }
-
-    /*
-     * Function: validate
-     * Validate a salted hash.
-     *
-     * Parameters:
-     *  $password - The password to test.
-     *  $pwhash   - The hash to test against.
-     *
-     * Returns:
-     *  True, if $password was correct, False otherwise.
-     */
-    public static function validate($password, $pwhash)
-    {
-        list($iterations, $hexsalt) = explode('$', $pwhash);
-        return self::hash($password, pack("H*", $hexsalt), $iterations) == $pwhash;
-    }
-}