I'm building an application that will have a user base, and I'm at the point of securing the login. I'm fairly new to programming (and PHP,) but my efforts thus far have pointed to using
Crypt() and a Blowfish hashed salt.
Before I go further, let me specify that I am not interested in phpass at this time.
crypt() documentation, a user recently posted this:
<?php $salt = substr(str_replace('+', '.', base64_encode(pack('N4', mt_rand(), mt_rand(), mt_rand(), mt_rand()))), 0, 22); ?>
It is intended for use on systems where mt_getrandmax() == 2147483647.
The salt created will be 128 bits in length, padded to 132 bits and then expressed in 22 base64 characters. (CRYPT_BLOWFISH only uses 128 bits for the salt, even though there are 132 bits in 22 base64 characters. If you examine the CRYPT_BLOWFISH input and output, you can see that it ignores the last four bits on input, and sets them to zero on output.)
Note that the high-order bits of the four 32-bit dwords returned by mt_rand() will always be zero (since mt_getrandmax == 2^31), so only 124 of the 128 bits will be pseudorandom. I found that acceptable for my application.
I tested my server, and indeed mt_getrandmax() returns 2147483647. I tried poking around the documentation to understand what the above code really does--the
pack() code N4 is for a 32-bit string (big endian byte order??) repeated 4 times... which I assume is why there's 4
What I don't understand is why he replaces
. and the purpose of 22 base64 characters (not that I fully understand what base64 is.)
It was recommended that I look into
openssl_random_pseudo_bytes() for my random salt generation, as the previous method I was looking at was limiting itself to just
Supposedly there was a bug pre 5.3.4 causing
openssl_random_pseudo_bytes() to run painfully slow, occassionally causing timeout errors. I'm not sure if I should try to use
Crypt() or something like the above method using
I'm trying to understand more how all these elements work, and what they are doing conceptually--rather than just using one without understanding it to achieve my goal; I'm trying to learn :P
Can someone help me understand the different elements at work here, or at least direct me to a knowledge base where I can read about it? I think the most eluding component is understanding the different formats/terminology (base64, ascii, hexdec, bit, byte, etc.) but also in the end, how to achieve a fairly secure salt for use with my passwords.