Question

I found the following example on php.net to secure password before storing it. However, I don’t quite understand line 3. Could someone explain this a little bit? Thanks!

1 <?php
2 $password = crypt('mypassword'); // let the salt be automatically generated

3 if (crypt($user_input, $password) == $password) {
4   echo "Password verified!";
5 }
6 ?>

Answer 1

crypt is a one-way function and returns a string that already contains the salt,

When comparing the user input with the crypt result, the function automatically extracts the salt from the string.

To be more clear :

crypt() outputs a string that contains both the salt and the result of the hash. When you pass it that string as a salt, it knows to extract only the salt part and ignore the hash part. And it still returns a string containing both the salt and the hash. So these strings can be compared

You can clearly understand by:

when user signups for the first time , the process is:

 $password = crypt($user_input); // let the salt be automatically generated

 if (crypt($user_input, $password) == $password) {
   echo "Password verified!";
 }

when user tries to login , the process will be :

if(crypt($user_passsword_currentlyin_db, $user_inputted_password) == $user_inputted_password) {
      echo "Password verified!";
}

Hope you get the thing 🙂

EDIT:

The output of crypt consists of:

When you pass this output as “salt” back to crypt, it will extract the right algorithm and salt, and use these for the operation. If there is only an algorithm mentioned, it uses this one and generate random salt. Otherwise it will choose a default algorithm and generate random salt. The hash part in the passed salt parameter is ignored.

So you can simply compare your stored_hash with crypt(password, stored_hash) – if it is equal, it quite likely was the right password.

Here is an pseudocode explanation (in PHP-like syntax) how crypt works:

function crypt($password, $salt)
{
   if (substr($salt,0 1) == "_") {
     $count = substr($salt, 1, 4);
     $real_salt = substr($salt, 5, 4);
     return "_" . $count . $real_salt . crypt_ext_des($password, $count, $salt);
   }
   if(substr($salt, 0, 3) == "$1$") {
     list($ignored, $real_salt, $ignored) = explode("$", $salt);
     return "$1$" . $real_salt . "$" . crypt_md5($password, $real_salt);
   }
   if(substr($salt, 0, 4) == "$2a$") {
      $cost = substr($salt, 4, 2);
      $real_salt = substr($salt, 7, 22);
       return "$2a$" . $cost . "$" . $real_salt . crypt_brypt($password, $real_salt, $cost);
  }
  // ... SHA256 and SHA512 analogons

  // no match => STD_DES
  $real_salt = substr($salt, 0, 2);
  return $real_salt . crypt_std_des($password, $real_salt);
}