使用password_hash和SHA256进行加密和解密

Question

I have two scripts, a verify.php and a register.php.

On my registration page I use this..

        $salt = hash('sha256', uniqid(mt_rand(), true) . $email);
        $storedHash = $salt . $password;

        for ( $i = 0; $i < 50000; $i ++ )
        {
            $storedHash = hash('sha256', $storedHash);
        }


        $sql = "INSERT INTO authentication (email, password, fname, lname, created_at) VALUES ('$email', '$storedHash', '$fname', '$lname', '$today')";

Here is my user-login class..

                <?php
                include 'dbinclude.php';



                // Class User
                class user {
                    var $username;
                    var $password;
                    var $hashed;
                    var $salt;
                    function loginUser() {
                                require 'dbinclude.php';
                                $sql = "SELECT * FROM authentication WHERE email='" . $this->username . "';";
                                $query = mysqli_query($conn,$sql);
                                $fetch = mysqli_fetch_assoc($query);
                                $id = $fetch['userid'];
                                $storedHash = $fetch['password'];

                                $salt = substr($storedHash, 0, 64);
                                $validateHash = $salt . $this->password;
                                $validateHash = hash('sha256', $validateHash);
                                if ($storedHash == $validateHash)
                                {
                                //The entered password is correct.
                                     $user = array(
                                        "status" => "allow",
                                        "email" => $fetch['email'],
                                        "fname" => $fetch['fname'],
                                        "lname" => $fetch['lname'],
                                        "id" => $id,
                                        "setupacc" => $fetch['setupacc'],
                                        "setupleads" => $fetch['setupleads'],
                                        "setupclients" => $fetch['setupclients'],
                                         "hash" => $storedHash,
                                         "salt" => $salt
                                    );  
                                    return $user;
                                }
                                else
                                { 
                                //The entered password is incorrect.
                             $user = array(
                                            "status" => "deny",
                                            "email" => $fetch['email'],
                                            "fname" => $fetch['fname'],
                                            "lname" => $fetch['lname'],
                                            "id" => $id,
                                            "setupacc" => $fetch['setupacc'],
                                            "setupleads" => $fetch['setupleads'],
                                            "setupclients" => $fetch['setupclients'],
                                            "hash" => $storedHash,
                                            "salt" => $salt
                                        );
                                        return $user;
                                }

                          }


                }



                ?>

On my login page I use the following code..

            <?php
            session_start();
            require 'includes/dbinclude.php';
            require 'includes/class.user.php';
            $email = mysqli_real_escape_string($conn, $_POST['email']);
            $password = mysqli_real_escape_string($conn, $_POST['password']);




            // New login object? or class..
            $login = new user();
            $login->username = $email;
            $login->password = $password;
            $loginstatus = $login->loginUser();

            $status = $loginstatus['status'];
            $fname = $loginstatus['fname'];
            $lname = $loginstatus['lname'];
            $id = $loginstatus['id'];
            $email = $loginstatus['email'];
            $setupacc = $loginstatus['setupacc'];
            $setupleads = $loginstatus['setupleads'];
            $setupclients = $loginstatus['setupclients'];

            // Set User Info in Session
            $_SESSION['email'] = $email;
            $_SESSION['fname'] = $fname;
            $_SESSION['lname'] = $lname;
            $_SESSION['id'] =  $id;
            $_SESSION['setupacc'] = $setupacc;
            $_SESSION['setupleads'] = $setupleads;
            $_SESSION['setupclients'] = $setupclients;


            // Debug Display
            echo "Class Pass: " . $login->password;
            echo "Salt: " . $loginstatus['salt'];
            echo "Hashed: " . $loginstatus['hash'];

            if($status == "denied") {

            ?>
            <script>
            location.replace("http://hashed.com/?alertstatus=notauthed");
            </script>
            <?php

            } elseif($status == "allow") {


            ?>
            <script>
            location.replace("http://hashed.com/app.php");
            </script>
            <?php


            } else {

            ?>
            <script>
            location.replace("http://hashed.com/?alertstatus=notauthed");
            </script>

            <?php
            }

            ?>

For some reason, it will not validate my hash on login. I can see its storing the hash, successfully parsing the salt but it will not validate?

Answer 1

Remember that hashing is a one way function, so there is no concept called 'decrypting' the hash. You do something to the password(hash it) and store it in the database. Next, when you need to verify a user provided password, you do the same thing to the user provided password (hash it or do the same hash transformations) and then compare the resulting hash with what you've saved in the database. If they match, then the user must have provided the correct password.

In your verify routine, you are fetching the salt as:

$salt = substr($storedHash, 0, 64);

but while creating the $storedHash, you've mangled and lost the original salt:

$storedHash = $salt . $password;

for ( $i = 0; $i < 50000; $i++ )
{
  $storedHash = hash('sha256', $storedHash);
}

After the above for loop, there is no way to get the original $salt from $storedHash .

You'll either need to change the way you are storing the hash and the salt(store the salt in database as well), or you'll need to change the way you are validating the user's password in $validateHash .

When you are hashing the initial $salt + $password 50,000 times, then you'll also need to do the same again when user provides the password, so your $validateHash should look something like:

   $salt = $this->salt; // salt is also stored in the database 
   $validateHash = $salt . $this->password;

        for ( $i = 0; $i < 50000; $i++ )
        {
            $validateHash = hash('sha256', $validateHash);
        }