I was using hash_pbkdf2 earlier today when I noticed something strange.

The normal way to generate a hash is to output the entire string like the code below which outputs a 128 character string (128 chars, 4 bit each, 512bit total):
echo hash_pbkdf2("sha512", "123456", "test", 30000, 0);

However I made a minor error which I noticed output a whole heap of extra data:
echo hash_pbkdf2("sha512", "123456", "test", 30000, 512);

What are the extra hex output by this bad code, I was under the impression that SHA-512 could only output a maximum of 512bits?


According to the function definition, you specified a bit length of 512. By default (raw_output = False) the extra bits come from the derived key.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.