I'm working on a site that has to have compatibility with older versions of PHP, which suffer from a high-bit issue in the Blowfish
crypt() implementation. Essentially, non-ASCII characters are not processed properly, and it may be possible for an attacker to reduce the brute-force space. There's a fix in 5.3.7, but I'll need to support earlier versions.
In order to work around the issue, I'm thinking of Base64 encoding the password prior to running it through
crypt(). The idea is that
base64_encode() is binary safe, and the output will never contain any characters whose most significant bit is set.
Is this a safe assumption, or should I look at an alternative method?