From here, in the code return substr(sha1(mt_rand()),0,22);
what is the point of taking the sha1 value? It is appended to the password and together they are hashed using Blowfish. Why not just append the randomly generated number?
class PassHash {
// blowfish
private static $algo = '$2a';
// cost parameter
private static $cost = '$10';
// mainly for internal use
public static function unique_salt() {
return substr(sha1(mt_rand()),0,22);
}
// this will be used to generate a hash
public static function hash($password) {
return crypt($password,
self::$algo .
self::$cost .
'$' . self::unique_salt());
}
// this will be used to compare a password against a hash
public static function check_password($hash, $password) {
$full_salt = substr($hash, 0, 29);
$new_hash = crypt($password, $full_salt);
return ($hash == $new_hash);
}
}
$2y$10$
and the next 22 characters are the used salt, you can reuse it to calculate the new hash. In contrast topassword_hash()
, the functionpassword_verify()
does not create it's own salt, it uses the extracted salt from the stored hash-value.