PHP的Crypt（）中的精度损失？ 相同的盐，不同的密码=相同的加密结果

Question

I am using Crypt() in PHP to encrypt passwords. Let's say salt is "bg",
Password is: "gg456456gg"

Encrypted result gives: "bgvQk9C2Pv27o"
But if I use password: "gg456456" - without two last characters, it gives same result.

Because of this, users are able to login without typing 100% exact password.

What's happening? I mean gg456456 and gg456456gg are two different passwords, why is encrypted result same?

Answer 1

Php.net on function crypt()

The standard DES-based crypt() returns the salt as the first two characters of the output. It also only uses the first eight characters of str, so longer strings that start with the same eight characters will generate the same result (when the same salt is used).

So use a different encryption method. Such as blowfish or sha-512. These will accept much longer strings

Eg SHA-512:

$encpassword = crypt($password,"$6$".$salt);

Used the method above (and same salt):

gg456456 -> $6$631080661$L2o7HNKfYrqB4H19vYe7fRWWLenQj2EcWqriNG9rX6ki1QKO2YytkylrYmZ8mhIr6XE19Ms4RW2of5Z/dsYRA/

gg456456gg -> $6$631080661$maGxQ2d7ZIPIdXDFN1sJJsIjTFEwD9dL/uljSXdKXeJU4E5miCzh1ZCao57sGDm9PrDhdPYPLGUvoy0HzTfqI.

Use a good random-number generator for your salt and voila you have a well encrypted password

Answer 2

The original crypt function on Unix systems only uses the first 8 characters of the password. Eventually we decided that was insecure and have switched to more secure password hashes.

The PHP crypt function selects the algorithm to use based on the salt you supply, and a two character alphanumeric salt like you used triggers that original crypt algorithm.

See http://php.net/manual/en/function.crypt.php for the list of algorithms and respective salts.