ircmaxell/password-compat

A compatibility library for the proposed simplified password hashing algorithm: https://wiki.php.net/rfc/password_hash

Monday, March 20, 2017
by ircmaxell
Repository
152 Watchers
2028 Stars
26,144,282 Installations

PHP
233 Dependents
26 Suggesters
405 Forks
15 Open issues
8 Versions
4 % Grown

The README.md

password_compat

, _(*1)

This library is intended to provide forward compatibility with the password_* functions that ship with PHP 5.5., _(*2)

See the RFC for more detailed information., _(*3)

Requirements

This library requires PHP >= 5.3.7 OR a version that has the $2y fix backported into it (such as RedHat provides). Note that Debian's 5.3.3 version is NOT supported., _(*4)

The runtime checks have been removed due to this version issue. To see if password_compat is available for your system, run the included version-test.php. If it outputs "Pass", you can safely use the library. If not, you cannot., _(*5)

If you attempt to use password-compat on an unsupported version, attempts to create or verify hashes will return false. You have been warned!, _(*6)

The reason for this is that PHP prior to 5.3.7 contains a security issue with its BCRYPT implementation. Therefore, it's highly recommended that you upgrade to a newer version of PHP prior to using this layer., _(*7)

Installation

To install, simply require the password.php file under lib., _(*8)

You can also install it via Composer by using the Packagist archive., _(*9)

Usage

Creating Password Hashes, _(*10)

To create a password hash from a password, simply use the password_hash function., _(*11)

    $hash = password_hash($password, PASSWORD_BCRYPT);

Note that the algorithm that we chose is PASSWORD_BCRYPT. That's the current strongest algorithm supported. This is the BCRYPT crypt algorithm. It produces a 60 character hash as the result., _(*12)

BCRYPT also allows for you to define a cost parameter in the options array. This allows for you to change the CPU cost of the algorithm:, _(*13)

    $hash = password_hash($password, PASSWORD_BCRYPT, array("cost" => 10));

That's the same as the default. The cost can range from 4 to 31. I would suggest that you use the highest cost that you can, while keeping response time reasonable (I target between 0.1 and 0.5 seconds for a hash, depending on use-case)., _(*14)

Another algorithm name is supported:, _(*15)

    PASSWORD_DEFAULT

This will use the strongest algorithm available to PHP at the current time. Presently, this is the same as specifying PASSWORD_BCRYPT. But in future versions of PHP, it may be updated to use a stronger algorithm if one is introduced. It can also be changed if a problem is identified with the BCRYPT algorithm. Note that if you use this option, you are strongly encouraged to store it in a VARCHAR(255) column to avoid truncation issues if a future algorithm increases the length of the generated hash., _(*16)

It is very important that you should check the return value of password_hash prior to storing it, because false or null may be returned if it encountered an error., _(*17)

Verifying Password Hashes, _(*18)

To verify a hash created by password_hash, simply call:, _(*19)

    if (password_verify($password, $hash)) {
        /* Valid */
    } else {
        /* Invalid */
    }

That's all there is to it., _(*20)

Rehashing Passwords, _(*21)

From time to time you may update your hashing parameters (algorithm, cost, etc). So a function to determine if rehashing is necessary is available:, _(*22)

    if (password_verify($password, $hash)) {
        if (password_needs_rehash($hash, $algorithm, $options)) {
            $hash = password_hash($password, $algorithm, $options);
            /* Store new hash in db */
        }
    }

Security Vulnerabilities

If you have found a security issue, please contact the author directly at ircmaxell@php.net., _(*23)

The Versions

20/03 2017

dev-master

9999999-dev https://github.com/ircmaxell/password_compat

A compatibility library for the proposed simplified password hashing algorithm: https://wiki.php.net/rfc/password_hash

Sources Download

MIT

The Development Requires

phpunit/phpunit 4.*

by Anthony Ferrara

password hashing

20/11 2014

1.0.x-dev

1.0.9999999.9999999-dev https://github.com/ircmaxell/password_compat

A compatibility library for the proposed simplified password hashing algorithm: https://wiki.php.net/rfc/password_hash

Sources Download

MIT

The Development Requires

phpunit/phpunit 4.*

by Anthony Ferrara

password hashing

20/11 2014

v1.0.4

1.0.4.0 https://github.com/ircmaxell/password_compat

A compatibility library for the proposed simplified password hashing algorithm: https://wiki.php.net/rfc/password_hash

Sources Download

MIT

The Development Requires

phpunit/phpunit 4.*

The Requires

php >= 5.3.7

by Anthony Ferrara

password hashing

library password-compat

A compatibility library for the proposed simplified password hashing algorithm: https://wiki.php.net/rfc/password_hash

ircmaxell/password-compat

The README.md

password_compat

Requirements

Installation

Usage

Security Vulnerabilities

The Versions

dev-master

The Development Requires

by Anthony Ferrara

1.0.x-dev

The Development Requires

by Anthony Ferrara

v1.0.4

The Development Requires

by Anthony Ferrara

1.0.3

by Anthony Ferrara

1.0.2

by Anthony Ferrara

1.0.1

by Anthony Ferrara

1.0.0

by Anthony Ferrara

dev-nicholas-grekas-xor-fix

The Requires

by Anthony Ferrara