共享主机的密码安全性（PHP 5.2+）

Question

I'm working on some PHP meant to be deployed to users' servers - likely cheap/shared hosting (meaning lowest-common-denominator PHP 5.2, no modification of PHP installation ). Common advice for password hashes seems to be bcrypt or scrypt, via installable extensions for PHP 5.2.

I've been thinking about using an iterated SHA-512 with a beefy per-user salt, but it doesn't sound like it really compares to bcrypt/scrypt.

Without the ability to modify the base PHP installation , what options do I have for strong password security?

Answer 1

The first thing I would say is that PHP 5.2 should not be considered. It was declared end-of life nearly two years ago, and hasn't had any security patches in that time, so any host still using it clearly doesn't take security seriously anyway. You should consider 5.3 as the minimum version these days.

No on to passwords...

The next version of PHP (v5.5) will have a set of functions built-in that provide standardised password hashing. The idea is to once-and-for all get rid of any excuse for bad password practice in PHP. Once this version is released, that will be the only recommended way to handle passwords.

In the meanwhile, you can download a compatibility library that implements the same functions for current PHP versions. Download it from here: https://github.com/ircmaxell/password_compat

My recommendation is to use this library, enclosed in a if(function_exists()) wrapper. That way you'll be using best practice, and also be ready to use the built-in funcs when 5.5 is released.

See also: http://www.h-online.com/open/news/item/PHP-5-5-should-reduce-password-sloppiness-1707835.html for reference.

Hope that helps.

Answer 2

As mentioned in the comments to the original question, a PHP < 5.2 implementation of PBKDF2 is available at http://crackstation.net/hashing-security.htm .

PBKDF2 is arguably a better option than bcrypt/scrypt, having been much more thoroughly studied and tested.