phpsecurityhashpasswordsphp-password-hash

password_compat for older php version


PHP 5.5 will support the password functions password_hash() and password_verify(). Also there is a file to add this functions in >5.3.7.

My problem is that I am currently running the debian package 5.3.3-7+squeeze14.

Is there a way to make this function available with this old PHP version?


Solution

  • So, before I get started, let me make one thing clear. I am the author of the library in question (and the patch for 5.5).

    With that said, what the others have mentioned is absolutely correct. The reason that 5.3.7 is the minimum version is that all versions prior have a bug in the bcrypt implementation that can lead to entropy loss in passwords using high-byte characters (code points >= 128).

    That's the main reason for 5.3.7 being the minimum version. And I would highly suggest upgrading to at least 5.3.7, but preferably latest (a number of significant security issues have been found in not-so-old versions).

    Now, what can you do if you're stuck on a lower version? You could fork the library and adjust $2y$ to $2a$. That will at least get you to work. Passwords generated in this manner will be portable with future versions (the library is designed to be able to verify older crypt() passwords).

    However, I would recommend that you do not do this. Just upgrade to a newer version of PHP. It's not that hard (there are deb packages from dotdeb that can do it for you).

    If you really are stuck on an older version, I would suggest that you use a library that's designed for this. Something like my PasswordLib or PhPass (Note that you should only use that linked version of the library, there are several others on github that are drastically different).