i am storing the password using hash_pbkdf2 but now ive hit on a problem

my code :

1.for register

    $salt = openssl_random_pseudo_bytes(125);//salt
    $final_pass = hash_pbkdf2("sha512",$pass,$salt,1,125);//where $pass is the password entered by the user

2.for login

   $found_pass=$row['salt'];//retrieve the salt in the db
   $final_pass= hash_pbkdf2("sha512",$password,$found_salt,1,125);

the login does not seem to work why is that?if anybody can help me

  • It might just be a typo in the code in the question, but above you assign to $found_pass where you retrieve the salt from the db, but use $found_salt where you try and use it on the next line. – Clart Tent Feb 25 '14 at 21:32
  • @danielpsc found salt is the salt retrieved from the db and i allready tried it but didnt work – Immortal Dude Feb 25 '14 at 21:40

Oh, Lord.

Look, Mr.coder. No disrespect, but if that code is going to production environment, then please ask somebody else to do it. I know we all have to start somewhere, but this is not where production security code should start. Having that said, let's address your question.

First of all, you're using hash_pbkdf2, which is a PHP 5.5 function. Since you're already coding for PHP 5.5, it's better to use the password_hash API. You only need two inputs for password_hash; the password, and the algorithm (PASSWORD_BCRYPT is recommended). The output is one string containing everything you need (the automatically-generated salt, the password, the algorithm and the iterations). You take that string and store it in the database.

Second, you're using one iteration. What's the point? You want to make the process as slow as possible, while keeping it as usable as possible. One iteration is extremely low. Start with 1000 as a bare minimum.

Third, what's with the gigantic salt? Anything higher than 128 bits (16 bytes) is unnecessary.

For verification (login), you only need one method; password_verify. You give the hash string (from the database), and the password. The output is either true for successful verification, or false for failed verification. Here's an example:

$hashString_ToTheDB = password_hash($userPass, PASSWORD_BCRYPT);

$isCorrectPassword = password_verify($userPass, $hashString_FromTheDB);
  • the hash value generated is a little small is it secure enough?and go easy on me im only 15 – Immortal Dude Feb 25 '14 at 22:08
  • @Mr.coder The digest of the password itself is 184 bit. It's more than just secure enough. – Adi Feb 25 '14 at 22:14

Not the answer you're looking for? Browse other questions tagged or ask your own question.