StackOverflow2013

Note that there are some explanatory texts on larger screens.

plurals

PO
text
Body
copied!<p><strong>crypt</strong> is a one-way function and returns a string that already contains the salt,</p> <p>When comparing the user input with the crypt result, the function automatically extracts the salt from the string.</p> <p>To be more clear :</p> <p>crypt() outputs a string that contains both the salt and the result of the hash. When you pass it that string as a salt, it knows to extract only the salt part and ignore the hash part. And it still returns a string containing both the salt and the hash. So these strings can be compared </p> <p>You can clearly understand by:</p> <p>when user signups for the first time , the process is:</p> <pre><code> $password = crypt($user_input); // let the salt be automatically generated if (crypt($user_input, $password) == $password) { echo "Password verified!"; } </code></pre> <p>when user tries to login , the process will be :</p> <pre><code>if(crypt($user_passsword_currentlyin_db, $user_inputted_password) == $user_inputted_password) { echo "Password verified!"; } </code></pre> <p>Hope you get the thing :)</p> <p><strong>EDIT:</strong></p> <p>The output of crypt consists of:</p> <p>When you pass this output as "salt" back to crypt, it will extract the right algorithm and salt, and use these for the operation. If there is only an algorithm mentioned, it uses this one and generate random salt. Otherwise it will choose a default algorithm and generate random salt. The hash part in the passed salt parameter is ignored.</p> <p>So you can simply compare your stored_hash with crypt(password, stored_hash) - if it is equal, it quite likely was the right password.</p> <p><strong>Here is an pseudocode explanation (in PHP-like syntax) how crypt works:</strong></p> <pre><code>function crypt($password, $salt) { if (substr($salt,0 1) == "_") { $count = substr($salt, 1, 4); $real_salt = substr($salt, 5, 4); return "_" . $count . $real_salt . crypt_ext_des($password, $count, $salt); } if(substr($salt, 0, 3) == "$1$") { list($ignored, $real_salt, $ignored) = explode("$", $salt); return "$1$" . $real_salt . "$" . crypt_md5($password, $real_salt); } if(substr($salt, 0, 4) == "$2a$") { $cost = substr($salt, 4, 2); $real_salt = substr($salt, 7, 22); return "$2a$" . $cost . "$" . $real_salt . crypt_brypt($password, $real_salt, $cost); } // ... SHA256 and SHA512 analogons // no match => STD_DES $real_salt = substr($salt, 0, 2); return $real_salt . crypt_std_des($password, $real_salt); } </code></pre>

Querying!

Guidance

An individual column

Larger individual text columns get their own page to allow for proper reading.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload