Linux Cryptography Problem?

[RobertP]

Catchy title? well that is exactly my problem. i have 2 methods inside my 'Member' class (code below).

As you an see, i am not getting the expected results from 'crypt'.

 

What started this problem was i have switched my development pc's operating system from win7 to Ubuntu 14, and there was a few small case-sensitive issues i had to fix while moving my site, however this is a security issue that was allowing anyone to login using the wrong password, that is before i added the 'if(strlen($newPassword)!=60)' check.

 

If anyone else has seen this issue, please let me know how you solved it

 

    public function setPassword($password) {
       $salt = Util::generateRndStr(;
       $newPassword = self::encrypt($password, $salt);
       echo 'pass='.$password.'<br />';
       echo 'salt='.$salt.'<br />';
       echo 'ePas='.$newPassword.'<br />';
       if(strlen($newPassword)!=60){
           trigger_error('Internal issue with Member::encrypt.',E_USER_WARNING);
           return false;
       }
       $statement = $this->connection->prepare('UPDATE members SET passwrd = ?, sal_t = ? WHERE id = ? LIMIT 1;');
       $id = $this->get('id');
       $statement->bindParam(1, $newPassword, PDO::PARAM_STR);
       $statement->bindParam(2, $salt, PDO::PARAM_STR);
       $statement->bindParam(3, $id, PDO::PARAM_INT);
       $statement->execute();
       return $statement->rowCount() == 1;
   }

   public static function encrypt($string, $salt) {
       return crypt($string, '$2y$10$' . $salt . '$');
   }

[Christian F.]

There are two possible causes:

Blowfish hashing with a salt as follows: "$2a$", "$2x$" or "$2y$", a two digit cost parameter, "$", and 22 digits from the alphabet "./0-9A-Za-z". Using characters outside of this range in the salt will cause crypt() to return a zero-length string.

(My emphasis.)

 

...developers targeting only PHP 5.3.7 and later should use "$2y$"...

 

Well... The PHP manual outlines a couple more, but the two above are the most likely ones from the little info you've provided us with so far. Without knowing exactly what the Util::generateRndStr () does all we can do is speculate. So if the two quotes above aren't of any help, please post the contents of that functions as well.

[RobertP]

terribly sorry, here is the requested method.

 

    public static function generateRndStr($length, $type = 0) {
       if ($length < 1)
           return null;
       switch ($type) {
           case 1://captcha.
               $possible = '23456789bcdfghjkmnpqrstvwxyz';
               break;
           case 2://sessions.
               $possible = 'abcdefghijklmnopqrstuvwxyz0123456789';
               break;
           default://all.
               $possible = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789';
       }
       $str = null;
       for ($i = 0; $i < $length; $i++)
           $str .= substr($possible, mt_rand(0, strlen($possible) - 1), 1);
       return $str;
   }

 

this is my results during testing, just so everyone can see the problem outright..

 

pass=1234
salt=tvFvbjGG
ePas=$2y$10$tvFvbjGG$

[Christian F.]

I refer to the added emphasis in my first quote.

[RobertP]

I refer to the added emphasis in my first quote.

 

Thank you, i have noticed that my salt was a little to small Not sure how it changed from 21 to 8.. but that fixed my problem.

 

Fix:

    public function setPassword($password) {
       $salt = Util::generateRndStr(21);
       $newPassword = self::encrypt($password, $salt);
       if(strlen($newPassword)!=60){
           trigger_error('Internal issue with Member::encrypt.',E_USER_WARNING);
           return false;
       }
       $statement = $this->connection->prepare('UPDATE members SET passwrd = ?, sal_t = ? WHERE id = ? LIMIT 1;');
       $id = $this->get('id');
       $statement->bindParam(1, $newPassword, PDO::PARAM_STR);
       $statement->bindParam(2, $salt, PDO::PARAM_STR);
       $statement->bindParam(3, $id, PDO::PARAM_INT);
       $statement->execute();
       return $statement->rowCount() == 1;
   }

[Christian F.]

21..? You should still be missing one digit. Glad to hear that it works though.