Is there a newer / improved / alternative version for phpass?

Question

I'm about to implement phpass into a new application because of its theoretical and technical arguments towards security. It is of course not the only security, but for hashing passwords this seems to me like the best available.

However, I don't get really happy when looking at its source code. It goes against some of my most basic code conventions, especially when it comes to security.

return $hash == $stored_hash;

I would always use the identical operator (===) on code around security.

if ($hash[0] == '*')
    $hash = crypt($password, $stored_hash);

I would always use curly brackets { with an if. It doesn't matter that much whether they are on the same line, but just omitting them even though it is possible doesn't give me a good feeling.

Also, there is no way of forcing the CRYPT_BLOWFISH method. Right now I do that by checking for the length to be exactly 60 chars in my own wrapper.

I was wondering if someone knows an updated version? An improved one which is maintained and checked upon by a larger community then just one person? A newer version which makes all possible usage of PHP5 for example unbuffered reads as the author himself already suggests?

Or maybe I'm just being paranoid with no real reason.

Answer 1

If it is a new application, use https://github.com/ircmaxell/password_compat for password hashing. It works with PHP >= 5.3.7 and reimplements the coming password functions of PHP 5.5.

There really is no alternative to secure password hashing.

Answer 2

My post is for those who prefer phpass due to it's backward compatibility, but would like to use an improved version.

I use the following improvements to phpass:

• Introducing more data to $random_state in the constuctor.
• Improve get_random_bytes() by adding more methods and by introducing more data to the entropy pool.
  Some of the code is from the SecurityMultiTool by padraic and from ircmaxell's RandomLib and password_compat.
• In gensalt_blowfish() if PHP_VERSION >= 5.3.7, use the new, fixed BLOWFISH salt id.

The full code, version in the comment updated, changes appended:

<?php
#
# Portable PHP password hashing framework.
#
# Version 0.3 / okaresz.v1
#
# Written by Solar Designer <solar at openwall.com> in 2004-2006 and placed in
# the public domain.  Revised in subsequent years, still public domain.
#
# There's absolutely no warranty.
#
# The homepage URL for this framework is:
#
#   http://www.openwall.com/phpass/
#
# Please be sure to update the Version line if you edit this file in any way.
# It is suggested that you leave the main version number intact, but indicate
# your project name (after the slash) and add your own revision information.
#
# Please do not change the "private" password hashing method implemented in
# here, thereby making your hashes incompatible.  However, if you must, please
# change the hash type identifier (the "$P$") to something different.
#
# Obviously, since this code is in the public domain, the above are not
# requirements (there can be none), but merely suggestions.
#
# okaresz.v1:
#
#  * Introducing more data to $random_state in the constuctor.
#  * Improve get_random_bytes() by adding more methods and by introducing more data to the entropy pool.
#    Some fo the code is from the SecurityMultiTool by padraic: https://github.com/padraic/SecurityMultiTool
#    and from ircmaxell's RandomLib: https://github.com/ircmaxell/RandomLib
#    and password_compat https://github.com/ircmaxell/password_compat
#  * In gensalt_blowfish() if PHP_VERSION >= 5.3.7, use the new, fixed BLOWFISH salt id.
#
class PasswordHash {
    var $itoa64;
    var $iteration_count_log2;
    var $portable_hashes;
    var $random_state;

    function PasswordHash($iteration_count_log2, $portable_hashes)
    {
        $this->itoa64 = './0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz';

        if ($iteration_count_log2 < 4 || $iteration_count_log2 > 31)
            $iteration_count_log2 = 8;
        $this->iteration_count_log2 = $iteration_count_log2;

        $this->portable_hashes = $portable_hashes;

        $this->random_state = microtime();
        if (function_exists('getmypid'))
            $this->random_state .= getmypid();
        $this->random_state .= md5(serialize($_SERVER));
    }

    function get_random_bytes($count)
    {
        $output = '';

        if( function_exists('openssl_random_pseudo_bytes' ) )
        {
            $output = openssl_random_pseudo_bytes($count, $usable);
            if (true === $usable) {
                return $output;
            }
        }
        if( function_exists('mcrypt_create_iv')
            && (version_compare(PHP_VERSION, '5.3.0') >= 0 )
            || (strtoupper(substr(PHP_OS, 0, 3)) !== 'WIN')
            && !defined('PHALANGER')
        ) {
            $output = mcrypt_create_iv($count, MCRYPT_DEV_URANDOM);
            if ($output !== false && strlen($output) === $count) {
                return $output;
            }
        }

        if (is_readable('/dev/urandom') &&
            ($fh = @fopen('/dev/urandom', 'rb'))) {
            $output = fread($fh, $count);
            fclose($fh);
        }

        if (strlen($output) < $count) {
            $output = '';
            $seed = microtime() . memory_get_usage();
            if( function_exists('gc_collect_cycles') )
                { gc_collect_cycles(); }
            else
            {
                $i = 0;
                while( $i < 32)
                    { $i += 1+(int)round(lcg_value()); }
            }

            $this->random_state .= $seed . microtime();
            for ($i = 0; $i < $count; $i += 16)
            {

                $this->random_state =  md5(microtime() . $this->random_state);
                $output .= pack('H*', md5(substr($this->random_state,0,16)));
            }
            $output = substr($output, 0, $count);
        }

        return $output;
    }

    function encode64($input, $count)
    {
        $output = '';
        $i = 0;
        do {
            $value = ord($input[$i++]);
            $output .= $this->itoa64[$value & 0x3f];
            if ($i < $count)
                $value |= ord($input[$i]) << 8;
            $output .= $this->itoa64[($value >> 6) & 0x3f];
            if ($i++ >= $count)
                break;
            if ($i < $count)
                $value |= ord($input[$i]) << 16;
            $output .= $this->itoa64[($value >> 12) & 0x3f];
            if ($i++ >= $count)
                break;
            $output .= $this->itoa64[($value >> 18) & 0x3f];
        } while ($i < $count);

        return $output;
    }

    function gensalt_private($input)
    {
        $output = '$P$';
        $output .= $this->itoa64[min($this->iteration_count_log2 +
            ((PHP_VERSION >= '5') ? 5 : 3), 30)];
        $output .= $this->encode64($input, 6);

        return $output;
    }

    function crypt_private($password, $setting)
    {
        $output = '*0';
        if (substr($setting, 0, 2) == $output)
            $output = '*1';

        $id = substr($setting, 0, 3);
        # We use "$P$", phpBB3 uses "$H$" for the same thing
        if ($id != '$P$' && $id != '$H$')
            return $output;

        $count_log2 = strpos($this->itoa64, $setting[3]);
        if ($count_log2 < 7 || $count_log2 > 30)
            return $output;

        $count = 1 << $count_log2;

        $salt = substr($setting, 4, 8);
        if (strlen($salt) != 8)
            return $output;

        # We're kind of forced to use MD5 here since it's the only
        # cryptographic primitive available in all versions of PHP
        # currently in use.  To implement our own low-level crypto
        # in PHP would result in much worse performance and
        # consequently in lower iteration counts and hashes that are
        # quicker to crack (by non-PHP code).
        if (PHP_VERSION >= '5') {
            $hash = md5($salt . $password, TRUE);
            do {
                $hash = md5($hash . $password, TRUE);
            } while (--$count);
        } else {
            $hash = pack('H*', md5($salt . $password));
            do {
                $hash = pack('H*', md5($hash . $password));
            } while (--$count);
        }

        $output = substr($setting, 0, 12);
        $output .= $this->encode64($hash, 16);

        return $output;
    }

    function gensalt_extended($input)
    {
        $count_log2 = min($this->iteration_count_log2 + 8, 24);
        # This should be odd to not reveal weak DES keys, and the
        # maximum valid value is (2**24 - 1) which is odd anyway.
        $count = (1 << $count_log2) - 1;

        $output = '_';
        $output .= $this->itoa64[$count & 0x3f];
        $output .= $this->itoa64[($count >> 6) & 0x3f];
        $output .= $this->itoa64[($count >> 12) & 0x3f];
        $output .= $this->itoa64[($count >> 18) & 0x3f];

        $output .= $this->encode64($input, 3);

        return $output;
    }

    function gensalt_blowfish($input)
    {
        # This one needs to use a different order of characters and a
        # different encoding scheme from the one in encode64() above.
        # We care because the last character in our encoded string will
        # only represent 2 bits.  While two known implementations of
        # bcrypt will happily accept and correct a salt string which
        # has the 4 unused bits set to non-zero, we do not want to take
        # chances and we also do not want to waste an additional byte
        # of entropy.
        $itoa64 = './ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789';

        $output = (version_compare(PHP_VERSION, '5.3.7') >= 0)? '$2y$' : '$2a$';
        $output .= chr(ord('0') + $this->iteration_count_log2 / 10);
        $output .= chr(ord('0') + $this->iteration_count_log2 % 10);
        $output .= '$';

        $i = 0;
        do {
            $c1 = ord($input[$i++]);
            $output .= $itoa64[$c1 >> 2];
            $c1 = ($c1 & 0x03) << 4;
            if ($i >= 16) {
                $output .= $itoa64[$c1];
                break;
            }

            $c2 = ord($input[$i++]);
            $c1 |= $c2 >> 4;
            $output .= $itoa64[$c1];
            $c1 = ($c2 & 0x0f) << 2;

            $c2 = ord($input[$i++]);
            $c1 |= $c2 >> 6;
            $output .= $itoa64[$c1];
            $output .= $itoa64[$c2 & 0x3f];
        } while (1);

        return $output;
    }

    function HashPassword($password)
    {
        $random = '';

        if (CRYPT_BLOWFISH == 1 && !$this->portable_hashes) {
            $random = $this->get_random_bytes(16);
            $hash =
                crypt($password, $this->gensalt_blowfish($random));
            if (strlen($hash) == 60)
                return $hash;
        }

        if (CRYPT_EXT_DES == 1 && !$this->portable_hashes) {
            if (strlen($random) < 3)
                $random = $this->get_random_bytes(3);
            $hash =
                crypt($password, $this->gensalt_extended($random));
            if (strlen($hash) == 20)
                return $hash;
        }

        if (strlen($random) < 6)
            $random = $this->get_random_bytes(6);
        $hash =
            $this->crypt_private($password,
            $this->gensalt_private($random));
        if (strlen($hash) == 34)
            return $hash;

        # Returning '*' on error is safe here, but would _not_ be safe
        # in a crypt(3)-like function used _both_ for generating new
        # hashes and for validating passwords against existing hashes.
        return '*';
    }

    function CheckPassword($password, $stored_hash)
    {
        $hash = $this->crypt_private($password, $stored_hash);
        if ($hash[0] == '*')
            $hash = crypt($password, $stored_hash);

        return $hash == $stored_hash;
    }
}

?>