Timeline for PHP AES-256 CBC faster than AES-128 CBC?
Current License: CC BY-SA 4.0
6 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Sep 17, 2019 at 10:15 | history | edited | Maarten Bodewes♦ | CC BY-SA 4.0 |
edited body
|
| Feb 19, 2016 at 13:58 | comment | added | Maarten Bodewes♦ |
It goes a long way with the salt and the time-constant verification, but I don't see how it includes the cost factor in the calculations. It could use bcrypt underneath, but I cannot verify that given the code above. I'm also not 100% if ord itself is actually time-constant.
|
|
| Feb 19, 2016 at 13:09 | comment | added | ikatic |
Thanks so much for the answer. I've started looking into password hasing, would you say this function is any good? $random = openssl_random_pseudo_bytes(18); $salt = sprintf('$2y$%02d$%s', 13, // 2^n cost factor substr(strtr(base64_encode($random), '+', '.'), 0, 22) ) $hash = crypt($password, $salt) $given_hash = crypt($given_password, $db_hash) function isEqual($str1, $str2){ $n1 = strlen($str1); if (strlen($str2) != $n1) { return false; } for ($i = 0, $diff = 0; $i != $n1; ++$i) { $diff |= ord($str1[$i]) ^ ord($str2[$i]); } return !$diff; }
|
|
| Feb 19, 2016 at 11:51 | vote | accept | ikatic | ||
| Feb 19, 2016 at 11:06 | comment | added | Maarten Bodewes♦ | Basically, with your current level of knowledge, you should not encrypt passwords, period. | |
| Feb 19, 2016 at 11:05 | history | answered | Maarten Bodewes♦ | CC BY-SA 3.0 |