API / Minn\Auth / PortableHash

PortableHash final class

Minn\Auth\PortableHash · public/minn/src/Minn/Auth/PortableHash.php · 86 lines

The portable phpass hash ("$P$"), from the published algorithm: an iteration count character, an eight character salt, and MD5 iterated over salt and password, encoded in phpass's own base64 alphabet. The reference stores it in the post-password cookie (2^13 iterations, and it accepts nothing weaker there), and still verifies it for application passwords and reset keys made before its fast hash, which is why both directions of each are accepted. Its pieces are public for phpass's own class, PasswordHash (probe identity-internals): the base64 encoding, both kinds of salt, and the hash with phpass's failure markers.

Used by 5

ApplicationPasswords Password PasswordReset Content\PasswordGate Login\LoginController

Constants and properties

const	`ALPHABET` = `'./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz'`
private	`BLOWFISH_ALPHABET` = `'./ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789'`	bcrypt's own base64 alphabet.
const	`MAX_LENGTH` = `4096`	The longest password hashed; a longer one is refused before any work, as the reference refuses it.

Public

static	`hash(string $password, int $countLog2 = 13): string`#	A portable hash of a password, 2^$countLog2 iterations (the reference's cookies carry 2^13); "*" for one too long.
static	`salt(string $input, int $countLog2): string`#	A portable setting: "$P$", the count's character, and six bytes of salt encoded.
static	`blowfishSalt(string $input, int $countLog2): string`#	A bcrypt setting: "$2a$", the two-digit cost, and the first sixteen bytes in bcrypt's base64.
static	`verify(string $password, string $hash): bool`#	Whether a password matches a portable hash from the published algorithm.
static	`crypt(string $password, string $setting): string`#	The hash for a setting; for a setting it cannot use ("$P$" or "$H$", a count from 7 to 30, eight characters of salt) phpass's marker "0", or "1" when the setting is itself "*0".
static	`encode(string $input, int $count): string`#	phpass's base64: little-endian groups of three bytes, $count bytes of the input.