0
public function kryptonite($string){
   $salt = "";
   $salt_vars = array_merge(range("A","Z"),range("a","z"),range(0,9));
   for($i=0;$i < 22;$i++){
        $salt.= $salt_vars[array_rand($salt_vars)];
   }
   return crypt($string, '$6$'.$salt);
  }

This returns on refresh:

$6$vnuqcEA70$CHWmPVsDVb.lVpq1PNsDn7.0fSmBX6FU2PlofK6dJOH7FQp6EdSsde3Aw6to8fY1L01/WOcWz8OIE0OxK1LTj.
$6$7lmp9sD4g$I0fAcDjno2Lf255gg6TxTLt9TRwR803ZXiU9BOWJXhWrGbJdPJ3LvAW9w2KbRZ/3EDSSbFrgF7rV7DdB0VliA0

If you closely at the first few lines it's changing constantly. I don't think Hashing is suppose to constantly change! So technically I'll never be able to test against this. Can someone help me with my kryptonite crypt function or explain to me what went wrong really.

5
  • 2
    Why do you not just use password_hash()? Also, $6$... is an invalid hash string. The SHA512 hash string has the format $6$rounds=N$hashstringhere$. You should read the documentation properly! Jun 23, 2014 at 2:29
  • 1
    1. Do not use array_rand for security. 2. Use password hashing API.
    – sectus
    Jun 23, 2014 at 2:45
  • @SverriM.Olsen I thought default was 5000 for rounds so you didn't have to declare it unless modifying it. And I can't use password_hash yet my PHP Version is 5.2.* (000webhost) sorry to say. I'm getting some money to buy hosting from GoDaddy so then I'll change the functions to support the new PHP
    – EasyBB
    Jun 23, 2014 at 4:15
  • 2
    @EasyBB Then use the compatibility library. Jun 23, 2014 at 4:18
  • I'll read more into tomorrow Thanks Sverri.
    – EasyBB
    Jun 23, 2014 at 4:20

3 Answers 3

2

As a matter of fact, hashing is supposed to randomly change - it's called random salting. Your crypt function is creating a random salt which is fed to the SHA-512 hasher.

The output of crypt() includes the salt value, which you would then use when hashing a password to compare it to the stored hash.

public function kryptonite($string, $salt = null){
    if ($salt === null) {
        $salt = "";
        $salt_vars = array_merge(range("A","Z"),range("a","z"),range(0,9));
        for($i=0;$i < 22;$i++){
            $salt.= $salt_vars[array_rand($salt_vars)];
        }
        $salt = '$6$' . $salt;
    }
    return crypt($string, $salt);
}

To use this, you'd just do the following:

$storedHash = '.....'; // fetched from database
$inputPassword = '.....'; // from the user

$salt = preg_match('/\$[0-9]\$(.+)\$/')[1]; // php 5.4+

if (kryptonite($inputPassword, $salt) == $storedHash) {
    //.... success
}

Note that the array_random implementation of creating a random salt isn't cryptographically secure - it'd be better to use openssl_random_pseudo_bytes() or mt_rand() or such.

2
  • I don't have 5.4+ :( Also I'd like to note I am teaching myself all of this with the occasional help from SO. I'm going to college for this and I haven't started this course. I usually jump ahead so I don't have to listen to the professors :)
    – EasyBB
    Jun 23, 2014 at 4:17
  • You should really upgrade... but anyway, the 5.4 bit is just the ability access array members directly from the result of the function call. Otherwise, you have to do $result = preg_match('...'); $salt = $result[1];
    – Sam Dufel
    Jun 23, 2014 at 13:59
1

You won't be able to get the same result when using array_rand() I'd recommend something like this if you're going to use salts and need a two way encryption

function parse($action, $string) {
    $output = false;
    $encrypt_method = "AES-256-CBC";

    // hash
    $key = hash('sha256', "random encryption key that must stay the same");

    // iv - encrypt method AES-256-CBC expects 16 bytes - else you will get a warning
    $iv = substr(hash('sha256', "ARANDOMIV"), 0, 16);

    if($action == 'encrypt') {
        $output = openssl_encrypt($string, $encrypt_method, $key, 0, $iv);
        $output = base64_encode($output);
    } else if( $action == 'decrypt' ){
        $output = openssl_decrypt(base64_decode($string), $encrypt_method, $key, 0, $iv);
    }
    return $output;
}
3
  • I don't want to encrypt or decrypt that is why I used crypt as its a one-way string hashing algorithm, though plus 1 for the openssl stuff man
    – EasyBB
    Jun 23, 2014 at 2:20
  • 1
    @EasyBB , hash cannot be decrypted.
    – sectus
    Jun 23, 2014 at 2:46
  • Then why do you classify your actions as encrypt and decrypt
    – EasyBB
    Jun 23, 2014 at 4:12
0

You won't get the same hashes when you're using the array_rand() function. The result needs to be deterministic.

Is there a reason why sha1() isn't good enough?

7
  • That is exactly what I thought, I watched a video on this to help me and this is what the guy said to do. Have any better solutions sir? sha1() is accessible to brute force. md5 and sha1 is even stated not to use it in the php docs
    – EasyBB
    Jun 23, 2014 at 2:14
  • 1
    @EasyBB Was it a video by a competent software developer or some kid off YouTube?
    – alex
    Jun 23, 2014 at 2:15
  • He seemed competent HAHA owns or did own www.worldofwebcraft.com
    – EasyBB
    Jun 23, 2014 at 2:15
  • What are you hashing? If it's for a password, you're doing it wrong. If you're after hashing (for example to quickly compare 2 files) then use an existing hashing function. I can't find in the docs where PHP states not to use sha1 for hashing (except for passwords, as mentioned above).
    – alex
    Jun 23, 2014 at 2:16
  • 1
    @EasyBB That's the docs stating not to use it in a certain context, not recommending against it outright. Anyway, if this is for passwords, use bycrypt.
    – alex
    Jun 23, 2014 at 2:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.