9

I'm learning about PHP's crypt() function and have been running some tests with it. According to this post, I should use a salt that's 22 characters long. I can, however, use a string that's 23 characters long with some limitations. When I use a 22 character long string I always get an outcome of '$2y$xxStringStringStringStri.HashHashHashHashHashHashHashHas'. I know the period is just part of the salt.

It seems that if I use 23 characters instead of just 22, I can successfully generate different hashes, but there is only 4 different outcomes for all 64 characters. The 23rd character "rounds down" to the nearest 1/4th of the 64 character alphabet (e.g. the 23rd character is "W" and rounds down to "O" or any number rounds down to "u")

v---------------v---------------v---------------v---------------
./ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz1234567890

All four of these crypt functions generate the same salt:

crypt('Test123','$2y$09$AAAAAAAAAAAAAAAAAAAAAq');
crypt('Test123','$2y$09$AAAAAAAAAAAAAAAAAAAAAr');
crypt('Test123','$2y$09$AAAAAAAAAAAAAAAAAAAAAs');
crypt('Test123','$2y$09$AAAAAAAAAAAAAAAAAAAAAt');

But this one is different:

crypt('Test123','$2y$09$AAAAAAAAAAAAAAAAAAAAAu');

So why shouldn't I use the 23rd character when it can successfully generate different outcomes? Is there some kind of glitchy behavior in PHP that should be avoided by not using it?

For clarification on how I'm counting the 23rd character in the salt:

crypt('Test123','$2y$08$ABCDEFGHIJKLMNOPQRSTUV');
//        The salt is '$ABCDEFGHIJKLMNOPQRSTUV'
//        Which will be treated as '$ABCDEFGHIJKLMNOPQRSTUO'
4

2 回答 2

2

它与哈希冲突有关。一旦超过 22 个字符，您生成的哈希就不再是唯一的，具体取决于NAMESPACE算法。换句话说，超过 22 个字符不会提高安全性，实际上会降低您的安全级别。

于 2013-03-05T16:43:06.390 回答
0

$ 不是实际盐的一部分。它是一个分隔符。

对于 Blowfish crypt，格式为 $2[axy]$log2Rounds$[salt][hash]。你描述它添加一个 . -- 那是因为你错过了最后一个字符。河豚的盐是 128 位。是的，您只能使用 126，但您只是在不必要地削弱盐分。

于 2013-05-10T15:03:02.237 回答