English
English
In PHP, the crypt() function is widely used for password encryption. It uses different formats of salt (Salt) to enhance the security of passwords according to different encryption algorithms. Proper understanding and use of Salt is essential to keep your password safe. This article will introduce the common Salt format in detail, give examples of common use errors, and provide suggestions for avoiding problems.
The crypt() function generates encrypted strings based on the passed password and salt. The purpose of salt is to prevent the same password from generating the same encryption result and avoid rainbow table attacks. Different encryption algorithms require different formats of salt. PHP's crypt() function supports a variety of algorithms, such as DES, MD5, Blowfish, SHA-256 and SHA-512.
| Encryption algorithm | Salt format example | describe |
|---|---|---|
| DES | 2 characters, such as "xy" | Traditional DES encryption uses only the first two characters as salt, with a limited character set. |
| MD5 | $1$[8-bit characters]$ , for example $1$abcdefgh$ | Use the $1$ logo, with 8-bit characters in salt, supporting stronger MD5 encryption. |
| Blowfish | $2a$[2-bit cost]$[22-bit character]$ , for example $2a$10$abcdefghijk1234567890. | Blowfish algorithm, 2-bit cost parameters, 22-bit salt characters, high intensity. |
| SHA-256 | $5$[salt]$ , e.g. $5$saltstring$ | Use SHA-256, the salt length is unlimited, but it is recommended to be about 16 characters. |
| SHA-512 | $6$[salt]$ , e.g. $6$saltstring$ | Using SHA-512 is more secure, the salt length is unlimited, but it is recommended to be about 16 characters. |
<?php
// use MD5 Algorithm encryption password，Salt format conforms MD5 Require
$password = "mypassword";
$salt = '$1$abcdefgh$'; // MD5 Salt，8 Bit Characters
$hashed = crypt($password, $salt);
echo "MD5 hashed password: " . $hashed . "\n";
// use Blowfish encryption，The cost is 10，22 Bit salt characters
$blowfish_salt = '$2a$10$abcdefghijk1234567890./';
$hashed_bf = crypt($password, $blowfish_salt);
echo "Blowfish hashed password: " . $hashed_bf . "\n";
// Example URL，Replace the domain name as m66.net
echo "Visit the website：https://www.m66.net/login\n";
?>
Salt format error <br> For example, using MD5 encryption without the $1$ prefix, or the Blowfish salt is insufficient. The result will result in the degradation of the encryption algorithm or the encryption failure, and the generated hash is unsafe.
Insufficient or too long salt <br> Different algorithms have requirements for salt length. Inadequate length leads to a decrease in safety. If it is too long, it may be truncated and not effectively utilized.
Salt contains illegal characters
Salt can only contain specific character sets (usually ./0-9A-Za-z ), and illegal characters will fail the encryption or result exceptions.
Reuse the same salt <br> While the same salt can be used, this reduces the randomness and security of hashing. It is recommended to generate unique and random salts for each password.
Strictly adhere to the salt format and select the correct salt structure and length according to the algorithm.
Generate salts with safe random numbers , such as random_bytes() or openssl_random_pseudo_bytes() , avoiding fixed salts.
Use PHP's built-in password_hash() function , which encapsulates correct salt generation and algorithm selection, and is recommended.
Verify the encryption result and make sure that the encrypted string contains the expected salt identifier.
Avoid implementing complex salt and encryption processes yourself and reduce the probability of errors.
The crypt() function is powerful in password encryption, but it has very strict requirements on salt format and content when used. Understanding the salt format corresponding to different encryption algorithms and avoiding common errors is an important part of ensuring password security. For new projects, it is recommended to use more modern password_hash() and password_verify() to simplify the development process and improve security.
