Question

First, I see that to use CRYPT_BLOWFISH, i need to use a 16 char salt starting with $2a$. However, the php.net documentation for crypt() says that some systems don’t support CRYPT_BLOWFISH. How often is that the case?

Next, from their example on the docs, I see I use crypt() as follows:

<?php
$password = crypt('mypassword'); // let the salt be automatically generated

/* You should pass the entire results of crypt() as the salt for comparing a
   password, to avoid problems when different hashing algorithms are used. (As
   it says above, standard DES-based password hashing uses a 2-character salt,
   but MD5-based hashing uses 12.) */
if (crypt($user_input, $password) == $password) {
   echo "Password verified!";
}
?>

In order to use CRYPT_BLOWFISH, would the only thing I need to modify be the first line to make it like so;

crypt('mypassword', '$2a$07$usesomesillystringforsalt$')

and then the rest of the lines are fine as is?

Answer 1

For PHP before 5.3.0 crypt() used the lib supplied by the OS. If you are using an earlier version, then you’d need to check your OS documentation to see if it is supported (check the value of the CRYPT_BLOWFISH constant) – if not then the algorithm is implemented within the mcrypt() extension for PHP.

The example you’ve quoted from the docs doesn’t seem to make much sense:

  $stored_password=fetch_password($user);

  if (crypt($_REQUEST['password'],$stored_password)===$stored_password) {
      // note that crypt automatically extracts the salt and alogrithm type
      // from $stored_password
      ....

You only need to specify the prefix ($2a$) when creating the password.

HTH

C.