Question

I am working on a website for a game. The accounts are created via the php based website, and the game login server is being prototyped in Python, and will be finalized in C. The problem I am having is that when I hash something in PHP, I am unable to reproduce the same result with the same starting data and salt in Python. I looked through the algorithm in PHP here http://www.akkadia.org/drepper/SHA-crypt.txt and compared it to the way I was doing it and noticed that PHP cuts off the null byte at the end. Although, other than that I havent had much luck.

Python:

def HashPassword(Salt,Password,Rounds=5000):
    passhash=hashlib.sha512(Password+Salt).digest()[:-1]
    for i in xrange(2,Rounds):
        passhash=hashlib.sha512(passhash+Salt).digest()[:-1]
    return passhash

PHP:

function HashPW($password, $salt = "")
{
    if(strlen($salt) == 0) $salt = RandChar(16);
    return crypt($password, '$6$rounds=5000$' . $salt . '$');
}

Answer 1

Here is some simpler Python code for you.

import crypt
def hashPassword(salt, password, rounds=5000):
    return crypt.crypt(password, '$6$rounds={:d}${}$'.format(rounds, salt))