Skip to content

Instantly share code, notes, and snippets.

@xeoncross
Created April 17, 2012 16:09
Show Gist options
  • Star 1 You must be signed in to star a gist
  • Fork 2 You must be signed in to fork a gist
  • Save xeoncross/2407214 to your computer and use it in GitHub Desktop.
Save xeoncross/2407214 to your computer and use it in GitHub Desktop.
blowfish hashing using PHP's crypt and mcrypt library
<?php
# From my question and answer at SO:
# http://stackoverflow.com/questions/10183103/security-of-generating-hash-salts-using-phps-mt-rand
function blowfish($string, $salt = NULL, $iterations = '12')
{
return crypt($string, $salt ?: "$2a\$$iterations$" . md5(mcrypt_create_iv(22, MCRYPT_DEV_URANDOM)));
}
$password = 'password';
$hash = blowfish($password);
if($hash == blowfish($password, $hash))
{
print "Matches\n";
print $hash . "\n";
}
print "Running a hashing loop...\n";
$time = microtime(TRUE);
for ($i = 0; $i < 100; $i++)
{
blowfish('password' + $i);
}
print (microtime(TRUE) - $time) . " ms\n\n";
@timw4mail
Copy link

What's the purpose of that md5 hash?

@xeoncross
Copy link
Author

The IV that mcrypt returns is not the allowed ./A-Za-z0-9 set of characters that is required by blowfish. Even the faster base64_encode would not return the correct set since it allows things like "+".

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment