Follow-up to this question: Strong PHP hashing without salt.

Without entering into the details, using bcrypt without salt/pepper is a bit complex for my case, so I'm staying on a "plain loop" implementation.

In the "version 1" below, I'm simply hashing the sha512 repeatedly, whereas in "version 2" I include the input data in each iteration:

$data = $websiteDomain . $myChildSchool . $myPetName . $etc;

// version 1
$result = $data;
for ($i = 0; $i < 1000000; ++$i) {
    $result = hash('sha512', $result, true);

// version 2
$result = '';
for ($i = 0; $i < 1000000; ++$i) {
    $result = hash('sha512', $data . $result, true);

$result = str_replace(['/', '+', '='], '', base64_encode($result));
$result = substr($result, 0, $passwordLength);

Is "version 2" more secure?

I'm thinking about stuff like parallelization for "version 1", where the first hash would be normally computed, then the 999,999 remaining hashes of each candidate would be computed using some parallelized processing.


using bcrypt without salt/pepper is a bit complex for my case

Use bcrypt with the cost parameter specified for key stretching, examples in the official doc: http://php.net/manual/en/function.password-hash.php

password_hash("unsalted password", PASSWORD_BCRYPT, ["cost" => $cost]);

Is it more complex? I don't think so.

Side note: all PHP versions where password_hash is supported, have automatic salt generation enabled by default. If not using PHP7, you can specify your own (salt parameter in the array) but I don't see the point of doing so.

  • It's for some specific use case, I don't want random salt as I need the hash to be reproducible. And as I mentioned in a comment above, defining a salt is a pain, also it just won't be possible in the future. – Gras Double Dec 28 '16 at 13:24
  • Apparently you misunderstood, by "bcrypt without salt" I don't mean "let the application generate the salt", but "use no salt" (i.e. empty, or constant). – Gras Double Dec 28 '16 at 13:32
  • Okay, I missed your previous topic. bcrypt is not capable of making reproducible hashes without providing the salt. I can't remember another SPL function for key stretching that would fit your needs. – Rápli András Dec 28 '16 at 13:32
  • But if you give up ever migrating to PHP7, you can still use it :) – Rápli András Dec 28 '16 at 13:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.