-1

I'm working on storing the password of my users in my database in a secure way. I read a bit and I was recommanded to use openssl_random_pseudo_bytes to generate my salt. I do:

bin2hex(openssl_random_pseudo_bytes($thenumberIwanttouse, $cstrong));

It works, but I was wandering two things:

-What should be the lenght of my salt and in my database, if my salt have 30 character for exemple, I would just need a varchar field with a length of 30?

-Will openssl_random_pseudo_bytes always generate a new salt?If not, should it mean that I need to compare my salt to all other existing salt in my database to make sure that there aren't any duplicate?

7
  • 7
    Use password_hash() and password_verify() they are the recommended method, and dont salt them they do it themselves. Dont re-invent the wheel, especially in this area hand cranked security is more likely to be wrong that better than a proper implementation. See the Manual
    – RiggsFolly
    Jan 26, 2016 at 14:51
  • if your'e generating random bytes, then DON'T use a varchar/text-type field. random bytes can/will randomly include what looks to be valid unicode character sequences, and varchar/text fields are subject to character set translation. this could mangle the salt's bytes by doing false character translations. use a blob/varbinary-type field instead.
    – Marc B
    Jan 26, 2016 at 14:54
  • What kind of field should I use then? Jan 26, 2016 at 14:59
  • If the password_hash() salt themself, how do they remember the salt they used? Don't the salt needs to be in the database? Jan 26, 2016 at 15:00
  • 1
    Remember, there was nothing wrong with the components of the Wireless router security mechanism WEP, it was just poorly implemented and not propery stress tested. So a useless security mechanism was born. Unless you are a security EXPERT, dont try and roll your own.
    – RiggsFolly
    Jan 26, 2016 at 15:06

1 Answer 1

3

The raw format length of the salt is 16 bytes and it is NOT hex-encoded. However, you are not supposed to generate it yourself, nor to have a separate field for salt in the database!

password_hash() will automatically generate a salt (and it will do that better than you could), and then store it in the hash itself - that's just how the algorithm works.

You shouldn't be using anything but password_hash() and password_verify() to make the whole thing work.

In addition, there are better alternatives to openssl_random_pseudo_bytes() for generating random data, such as random_bytes() under PHP7, or it's backport for older PHP versions - the random_compat package.

11
  • The thing is, I was reading this: crackstation.net/hashing-security.htm#normalhashing. It semed to me that that personne really knew what I was doing, but is it that in php, all I need is really just password_hash() and password_verify()? Even when I was studying, I was told to store the salt in my database, but in this, paste the salt to a certain php function... How can I know who is actually wright? Jan 26, 2016 at 15:07
  • 2
    Did I not say this already in my comments Nobody likes a comment snaffler!
    – RiggsFolly
    Jan 26, 2016 at 15:09
  • You hadn't wrote your comment yet when I posted this. Jan 26, 2016 at 15:12
  • @KévinDuguay Yes, under PHP, all you need is password_hash() and password_verify(). The article you've linked to is indeed written by somebody who knows what they're doing, but it is not a tutorial on how to do password hashing under PHP.
    – Narf
    Jan 26, 2016 at 15:12
  • 1
    @Narf Comment 21mins ago, your post 11mins ago basic maths
    – RiggsFolly
    Jan 26, 2016 at 15:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.