bcrypt and randomly generated salts

by

Have a good look at the values you’re dealing with. The random salt generated will be, say:

abcdefg...

What is fed into crypt looks like this:

crypt($password, '$2y$10$abcdefg...')
                   |  |    |
                   |  |    +- the salt
                   |  +- the cost parameter
                   +- the algorithm type

The result looks like:

$2y$10$abcdefg...123456789...
 |  |    |        |
 |  |    |        +- the password hash
 |  |    +- the salt
 |  +- the cost parameter
 +- the algorithm type

In other words, the first part of the resulting hash is the same as the original input into the crypt function; it contains the algorithm type and parameters, the random salt and the hash result.

Input:  $password + $2y$10$abcdefg...
Output:             $2y$10$abcdefg...123456789...
                    ^^^^^^^^^^^^^^^^^
                   first part identical

When you confirm a password, you need the same, original salt again. Only with the same salt will the same password hash to the same hash. And it’s still there in the hash, in a format that can be passed to crypt as is to repeat the same operation as when the hash was generated. That’s why you need to feed both the password and hash into the validation function:

crypt($passwordToCheck, '$2y$10$abcdefg...123456789...')

crypt takes the first defined number of characters, up to and including abcdefg... and throws the rest away (that’s why the salt needs to be a fixed number of characters). Therefore it equals the same operation as before:

crypt($passwordToCheck, '$2y$10$abcdefg...')

And will generate the same hash, if and only if $passwordToCheck is the same.

More Related Contents:

  1. How do you use bcrypt for hashing passwords in PHP?
  2. How to use PHP’s password_hash to hash and verify passwords
  3. How can I store my users’ passwords safely?
  4. Where to put password_verify in login script?
  5. How to retract a salted password from the Database and auth user?
  6. Why does crypt/blowfish generate the same hash with two different salts?
  7. Maximum length of generated hash when using password_hash?
  8. Call to undefined function password_hash()
  9. What is SALT and how do i use it?
  10. don´t recognize variable of php
  11. Can't echo items from array
  12. Pagination data
  13. Call to a member function on a non-object [duplicate]
  14. How do I log errors and warnings into a file?
  15. How to sort files by date in PHP
  16. PHP curly brace syntax for member variable
  17. Doctrine 2 and Many-to-many link table with an extra field
  18. Send post request using Volley and receive in PHP
  19. PHP-FPM doesn’t write to error log
  20. Merging two multidimensional arrays on specific key
  21. PHP & Sessions: Is there any way to disable PHP session locking?
  22. Calculate total seconds in PHP DateInterval
  23. Why is calling a function (such as strlen, count etc) on a referenced value so slow?
  24. How to use the CSV MIME-type?
  25. Authenticating in PHP using LDAP through Active Directory
  26. Interleaving multiple arrays into a single array
  27. php artisan migrate throwing [PDO Exception] Could not find driver – Using Laravel
  28. php variable scope
  29. How to avoid “Using temporary” in many-to-many queries?
  30. PHP’s preg_replace regex that matches multiple lines

Leave a Comment