5

I am a newbie to PHP and password hashing. I am following the instructions provided @ Safe Password Hashing to hash my user password before storing.

My questions are:

  1. PHP recommends password_hash() method as a preferred secure way to hash. In case of a database breach won’t the hacker use password_verify() and identify the passwords rather than using a rainbow look up table?

  2. If so, what should be my approach to close this security gap?

Mr.X
  • 193
  • 1
  • 7
  • Sure they can, it's called a brute force attack, and it's way less efficient than rainbow tables. – Ajedi32 Nov 12 '15 at 04:00

4 Answers4

5

password_verify() takes two arguments: a string of which you want to check if it's the correct password, and the value you calculated earlier with password_hash(), which you presumably stored somewhere in a database or so.

A typical application could be:

<?php
$hash = password_hash('my-secret', PASSWORD_DEFAULT);
// normally you would save the hash somewhere, but we'll just continue in this example

$check_a = 'other-secret';
$check_b = 'my-secret';
if (password_verify($check_a, $hash))
   echo 'Check A was the original password: ' . $check_a;
if (password_verify($check_b, $hash))
   echo 'Check B was the original password: ' . $check_b;

The output will be:

Check B was the original password: my-secret

If you want to get the original password from a hash calculated by password_hash(), you'll need to try all possibilities - that's what this example shows. Because of the architecture of password_hash(), finding a password like this will take a long time, so it's not worth it.

Note also, from the password_hash() doc:

PASSWORD_DEFAULT - Use the bcrypt algorithm (default as of PHP 5.5.0). Note that this constant is designed to change over time as new and stronger algorithms are added to PHP. For that reason, the length of the result from using this identifier can change over time. Therefore, it is recommended to store the result in a database column that can expand beyond 60 characters (255 characters would be a good choice).

The algorithm is designed to change over time, so that it stays secure, and finding a password by brute force won't become possible with faster computers (presuming, the PHP installation on your server is up to date)

In any case, a hash is one-way: you can't turn it around. You can only verify a given password by computing the hash of that one, and checking if it's the same.

0

The only way to actually get the real password is use a brute force attack on the hashed password, as the default php password hash algorithm is bcrypt it would take a hell of a lot of time.

xen
  • 1
0

password_verify() will only confirm if a given password matches the given hash. It still requires an input, and rainbow tables are a way to generate possible passwords for input. However, if you're generating a recommended size salt value it will help protect against rainbow table attacks.

You can find more on correctly securing passwords using hashes and salts by reading How to Securely Hash Passwords.

Community
  • 1
RoraΖ
  • 12,347
  • 4
  • 51
  • 83
  • Thanks for the reply I completely forgot the part where the password is required as the input. – Mr.X Nov 18 '14 at 13:33
  • Although it is not the answer to your question, you should read this: https://crackstation.net/hashing-security.htm – Bob Brown Nov 18 '14 at 13:36
0

Since the hash functions are really hard to invert you can't simply deduce a solution by providing the hash. There is a negligible probability that an attacker can develop a strategy to find a password that's digest matches with the one you store at the database. Don't know whats PHP's default hash method but all the modern hashing algorithms are collision resistant, so no worries.

Ugur
  • 1