crypt – PHP String Functions

Syntax :

Description :

It is One-way string hashing.

The crypt() function returns hashed string on the basis of algorithms i.e Standard DES-based hash,  Extended DES-based hash,MD5 hashing, Blowfish hashing or algorithm may be different from system to system, as it basically depends on your system.

This function behaves different on different operating systems. PHP checks what algorithms are available and what algorithms to use when it is installed.

Note : This function is not yet binary safe.

Note : As of PHP 5.3.0, PHP contains its own implementation and will use that if the system lacks of support for one or more of the algorithms.

Parameter :

• string – It is Required parameter. String which is to be hashed.
• salt – It is Optional parameter. A salt string which is to base the hashing on. With out salt the output will result in unexpected behavior.

It has some constants on systems where the crypt() function supports multiple hash types, the following constants are set to “0” or “1” depending on whether the given type is available:

• CRYPT_STD_DES – Standard DES-based hash with a two character salt from the alphabet “./0-9A-Za-z”. Using invalid characters in the salt will cause this function to fail.
• CRYPT_EXT_DES – Extended DES-based hash. The “salt” is a 9-character string consisting of an underscore followed by 4 bytes of iteration count and 4 bytes of salt. These are encoded as printable characters, 6 bits per character, least significant character first. The values 0 to 63 are encoded as “./0-9A-Za-z”. Using invalid characters in the salt will cause this function to fail.
• CRYPT_MD5 – MD5 hashing uses a twelve character salt starting with $1$.
• CRYPT_BLOWFISH – Blowfish hashing with a salt as follows: “$2a$”, “$2x$” or “$2y$”, a two digit cost parameter, “$”, and 22 characters from the alphabet “./0-9A-Za-z”. Using characters outside of this range in the salt will cause crypt() to return a zero-length string. The two digit cost parameter is the base-2 logarithm of the iteration count for the underlying Blowfish-based hashing algorithmeter and must be in range 04-31, values outside this range will cause this function to fail. Versions of PHP before 5.3.7 only support “$2a$” as the salt prefix: PHP 5.3.7 introduced the new prefixes to fix a security weakness in the Blowfish implementation. Please refer to » this document for full details of the security fix, but to summarise, developers targeting only PHP 5.3.7 and later should use “$2y$” in preference to “$2a$”.
• CRYPT_SHA256 – SHA-256 hash with a sixteen character salt prefixed with $5$. If the salt string starts with ’rounds=<N>$’, the numeric value of N is used to indicate how many times the hashing loop should be executed, much like the cost parameter on Blowfish. The default number of rounds is 5000, there is a minimum of 1000 and a maximum of 999,999,999. Any selection of N outside this range will be truncated to the nearest limit.
• CRYPT_SHA512 – SHA-512 hash with a sixteen character salt prefixed with $6$. If the salt string starts with ’rounds=<N>$’, the numeric value of N is used to indicate how many times the hashing loop should be executed, much like the cost parameter on Blowfish. The default number of rounds is 5000, there is a minimum of 1000 and a maximum of 999,999,999. Any selection of N outside this range will be truncated to the nearest limit.

Output :

Returns the hashed string or a string that is shorter than 13 characters and is guaranteed to differ from the salt on failure.

ChangeLog :

[table caption=”” width=”100%” colwidth=”15%|85%” colalign=”left|left”]
Version, Description
PHP 5.6.5 , When the failure string “*0” is given as the salt it will return “*1” for consistency with other crypt implementations. Prior to this version i.e PHP 5.6 would incorrectly return a DES hash.

PHP 5.6.0, Raise E_NOTICE security warning if salt is omitted.

PHP 5.5.21, When the failure string “*0” is given as the salt it will return “*1” for consistency with other crypt implementations. Prior to this version i.e PHP 5.5 (and earlier branches) would incorrectly return a DES hash.

PHP 5.3.7, Added $2x$ and $2y$ Blowfish modes to deal with potential high-bit attacks.

PHP 5.3.2, Added SHA-256 and SHA-512 crypt based on Ulrich Drepper’s.

PHP 5.3.2, Fixed Blowfish behaviour on invalid rounds to return “failure” string (“*0” or “*1”)  instead of falling back to DES.

PHP 5.3.0, PHP now contains its own implementation for the MD5 crypt / Standard DES/ Extended DES and the Blowfish algorithms and will use that if the system lacks of support for one or more of the algorithms.

[/table]

Related articles : hash_equals() , password_hash() , md5() .

crypt() – PHP Functions Example 1 :

In below example we will be using different algorithms:

<?php
/* These salts are examples only, and should not be used as it is in your code.
 You should generate a unique/distinct, correctly-formatted salt for each password.
*/
echo "<b>Crypting without salt.</b></br>";
if (CRYPT_STD_DES == 1) {
echo 'Standard DES: ' . crypt('tutorialmines') . "</br>\n";
}
else {
 echo "Standard DES not supported here\n</br>";
}

// character salt
echo "<b>Crypting with Extended DES using salt.</b></br>";
if (CRYPT_EXT_DES == 1) {
 echo 'Extended DES: ' . crypt('tutorialmines', '_J9..usesaltstringhereforsalt') . "</br>\n";
}
else {
 echo "Extended DES not supported here\n</br>";
}

// 12 character salt starting with $1$
echo "<b>Crypting with MD5 using salt and it starts with $1$.</b></br>";
if (CRYPT_MD5 == 1) {
 echo 'MD5: ' . crypt('tutorialmines', '$1$usesaltstringhereforsalt$') . "</br>\n";
}
else {
 echo "MD5 not supported here\n<br>";
}

// Salt starting with $2a$. The two digit cost parameter: 09. 22 characters
echo "<b>Crypting with BLOWFISH using salt and it starts with $2a$.</b></br>";
if (CRYPT_BLOWFISH == 1) {
 echo 'Blowfish: ' . crypt('tutorialmines', '$2a$07$usesaltstringhereforsalt$') . "</br>\n";
}
else {
 echo "Blowfish not supported here\n<br>";
}

// 16 character salt starting with $5$. The default number of rounds is 5000.
echo "<b>Crypting with SHA-256 using salt and it starts with $5$.</b></br>";
if (CRYPT_SHA256 == 1) {
 echo 'SHA-256: ' . crypt('tutorialmines', '$5$rounds=5000$usesaltstringhereforsalt$') . "</br>\n";
}
else {
 echo "SHA-256 not supported here\n<br>";
}

// 16 character salt starting with $6$. The default number of rounds is 5000.
echo "<b>Crypting with SHA-512 using salt and it starts with $6$.</b></br>";
if (CRYPT_SHA512 == 1) {
 echo 'SHA-512: ' . crypt('tutorialmines', '$6$rounds=5000$usesaltstringhereforsalt$') . "\n";
}
else {
 echo "SHA-512 not supported here\n<br>";
}
?>

Output will be like below(depending on the operating system):