Is this code snippet good enough for password hash and salt

Question

After a few days reading up about salting and hashing passwords, I found an actual bit of code that tells how to do it. This is what I found:

$blowfish_salt = bin2hex(openssl_random_pseudo_bytes(22));  
$hash = crypt($data, "$2a$12$".$blowfish_salt);  

Is this a good way to do it?

Answer 1

1. It's easier to use the php 5.5 password_hash function, or if you're using an older version, the compatibility library
2. openssl_random_pseudo_bytes sometimes suffers from performance issues. Consider mcrypt_create_iv (size, MCRYPT_DEV_URANDOM) instead.

3. salt encoding is tricky. Hex doesn't use the space optimally, and normal Base64 uses invalid characters.

   $salt = substr(strtr(base64_encode($randomSalt), '+', '.'), 0, 22);
   

   should do the trick.

Combining these you get

$binarySalt = mcrypt_create_iv(16, MCRYPT_DEV_URANDOM);
$salt = substr(strtr(base64_encode($binarySalt), '+', '.'), 0, 22);

Check Seven Ways To Screw Up BCrypt on ircmaxell's blog for further reading.

Answer 2

There isn't anything wrong with your code. However, I always prefer to use ready made libraries for password hashing whenever possible. For PHP, there is an excellent implementation available over at PHPass.

require('PasswordHash.php');

$pwdHasher = new PasswordHash(8, FALSE);

$hash = $pwdHasher->HashPassword( $password );

Verification is done for you as well.

$checked = $pwdHasher->CheckPassword($password, $hash);
if ($checked) {
    echo 'password correct';
} else {
    echo 'wrong credentials';
}

Answer 3

You are doing it correctly. The salt you are generating is considered random and long enough (note a salt needs to be unique per password). You are also using bcrypt which is considered a secure password hashing algorithm.