比较加密的密码mysql / php

Question

Database encrypts password in the following way:

encrypt('password', CONCAT('$', MD5(RAND()))));

I'm selecting this value in PHP, and I would like to compare it to user input. So how would I recreate above in PHP? What I don't get is this, if encrypted password relies on random number, how is it possible to generate same string in php and compare it to original?

Answer 1

Best way would be to use stored procedure or function on the database site that will return true/false for user/pass query. That way you'll have only one function in one pleace.

Even if you don't want to create one of those than use same funcions inside db query produced by php.

Answer 2

You are right, theres no way to recreate the password in php since the salt is not being provided in the mysql function. What I sugest is providing the same salt in both mysql and php. Make sure to keep this value in a safe place.

Per mysql encrypt documentation:

Encrypts str using the Unix crypt() system call and returns a binary string. The salt argument must be a string with at least two characters or the result will be NULL. If no salt argument is given, a random value is used.

Note the last part: if no salt argument is given, a random value is used (your case).

Answer 3

It seems that the MySql function encrypt() uses the Unix crypt() function. In this case you most likely create unsafe DES hashes and the "salt" will be stored as part of the resulting hash-value. For verification you could use the PHP crypt() function like this:

$isPasswordCorrect = crypt($password, $existingHashFromDb) === existingHashFromDb;

Please note that it is very unsafe to store passwords in this form, because this hash algorithm is ways too fast for hashing passwords. Instead you should use a key-derivation function like BCrypt, PHP has it's own function password_hash() for this:

// Hash a new password for storing in the database.
// The function automatically generates a cryptographically safe salt.
$hashToStoreInDb = password_hash($password, PASSWORD_BCRYPT);

// Check if the hash of the entered login password, matches the stored hash.
// The salt and the cost factor will be extracted from $existingHashFromDb.
$isPasswordCorrect = password_verify($password, $existingHashFromDb);