Crypt、blowfish和hashing

Question

我打赌已经有关于这方面的脚本了，但我创建这个项目只是为了好玩和测试我的知识，现在我只是想要公众的意见，如果你们找到一种方法可以改进我也可以自由地分享对它的评论。

我的问题很简单，就是如何创造一个好的盐。在阅读了手册和几个章节之后，这就是我想出来的。不过，为了安全起见我觉得我的盐应该放长点。我应该改变什么？

这是我的user类。请检查genSalt()函数，并指导我找出如何改进我的结果。

    <?php
if(!defined('ACCESS_CORE')){
    echo 'Permission Not Granted';
    exit;
}

class user{
    private $_email;
    private $_pass;
    private $_db;   
    private $_url;


    function __construct(){
        $this->_db = $this->db();
        $this->_url = 'localhost'; //change this to ur url 
        if(isset($_POST['user_login'])){
            $this->_email = $this->clean($_POST['user_email']); //sanitize later
            $this->_pass = $this->clean($_POST['user_password']);
        }
    }

    protected function db(){
        $db = parse_ini_file('../contra.conf');
        $this->_db = new mysqli($db['host'], $db['user'], $db['pass'], $db['name']);
        if ($this->_db->connect_errno) {
         trigger_error("Failed to connect to MySQL".$mysqli->connect_errno). $mysqli->connect_error;
        }   
    }

    protected function clean($string){
        return mysql_real_escape_string($string); #TODO: add more options html etc
    }

    public function safeReferer(){ 
        $ref = (isset($_SERVER['HTTP_REFERER']) ? $_SERVER['HTTP_REFERER'] : ''); //if there is a ref..
        if(empty($ref) || strpos($ref, $this->_url)){
            return true;
        } else {
            return false;
        }
    }

    public function includeForm($message = ""){ #TODO: finish form view page
         ?>
        <div id="logForm">
            <h3>User Authentication Form</h3>
        <?php  echo ($message === "") ? '' : $message; ?>
                <form id="loginForm" method="post" action="login.php">
                    <input type="text" name="user_email" />
                    <input type="password" name="user_password" />
                    <input type="submit" value="Login" name="user_login" />
                    <a href="/" >Forgot password?</a>
                </form>
            </div>

        <?php ;
    }

    protected function genSalt($length) {  #TODO: improve something is fishy
        $prefix = '$2a$'.$length.'$'; //blowfish prefix
        //base64 unique random alphanumeric
        $uniqRand = base64_encode(mcrypt_create_iv($length, MCRYPT_DEV_URANDOM)); 
        $modified_string = str_replace('+', '.', $uniqRand);  
        $salt = substr($modified_string, 0, $length);
        return $prefix.$salt.'$';
    }


     protected function correctPass($password, $salt){ #TODO: change to prepared statement. best method?
        $sql = "SELECT pass, s FROM users WHERE email = '$this->_email'";
            if($result = $this->_db->query($sql)){
                while ($row = $result->fetch_object()) {
                    if(cript($row['pass'], $row['s']) === $row['s']){
                        return true;
                    } else {
                        return false;
                    }
                }    
            }
    }


    public function login(){
        if($this->correctPass($this->_email, $this->_pass)){
            echo 'create session, session cookie, start timeout, and redirect'; #TODO: copy login, finish page on form view
        } else {
            $message = '<h5>Please try again</h5>';
            $message .= '<p>It looks like you have either entered a wrong user name or password.';
            $this->includeForm($message);
        }
    }

// test function, similar function in register class
   public function createPass($pass){
       $salt = $this->genSalt(10);
       $hash = crypt($pass, $salt);
       echo $salt. '--';
       echo 'hashed pass : '. $hash;
       echo '<br> entered pass : '.$pass.'<br>';
       if(crypt($pass, $hash) == $hash ){
                        echo  'true';
                    } else {
                        echo 'false';
                    }
   }
}

?>

测试函数结果...$2a$10$WlUvRqsgZl$--

哈希传递：$2a$10$WlUvRqsgZl$tRNdwECDQXhN07g4mIp82xxFCTUev3m输入的传递: mypassword true

Answer 1

为什么不考虑password_hash函数呢？它也会散列，但每次都会生成一个随机的盐，并默认使用河豚。但是，它需要PHP5.5或更高版本。