mirror of
https://github.com/sigmasternchen/php-doc-en
synced 2025-03-23 04:18:56 +00:00
7e65787ddc
-- Provided by anonymous 63625 (php@dennis.birkholz.biz) git-svn-id: https://svn.php.net/repository/phpdoc/en/trunk@340333 c90b9560-bf6c-de11-be94-00142212c4b1
337 lines
10 KiB
XML
337 lines
10 KiB
XML
<?xml version="1.0" encoding="utf-8"?>
|
|
<!-- $Revision$ -->
|
|
|
|
<refentry xml:id="function.password-hash" xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink">
|
|
<refnamediv>
|
|
<refname>password_hash</refname>
|
|
<refpurpose>Creates a password hash</refpurpose>
|
|
</refnamediv>
|
|
|
|
<refsect1 role="description">
|
|
&reftitle.description;
|
|
<methodsynopsis>
|
|
<type>string</type><methodname>password_hash</methodname>
|
|
<methodparam><type>string</type><parameter>password</parameter></methodparam>
|
|
<methodparam><type>integer</type><parameter>algo</parameter></methodparam>
|
|
<methodparam choice="opt"><type>array</type><parameter>options</parameter></methodparam>
|
|
</methodsynopsis>
|
|
<para>
|
|
<function>password_hash</function> creates a new password hash using a strong one-way hashing
|
|
algorithm. <function>password_hash</function> is compatible with <function>crypt</function>.
|
|
Therefore, password hashes created by <function>crypt</function> can be used with
|
|
<function>password_hash</function>.
|
|
</para>
|
|
<simpara>
|
|
The following algorithms are currently supported:
|
|
</simpara>
|
|
<para>
|
|
<itemizedlist>
|
|
<listitem>
|
|
<simpara>
|
|
<constant>PASSWORD_DEFAULT</constant> - Use the bcrypt algorithm (default as of PHP 5.5.0).
|
|
Note that this constant is designed to change over time as new and stronger algorithms are added
|
|
to PHP. For that reason, the length of the result from using this identifier can change over
|
|
time. Therefore, it is recommended to store the result in a database column that can expand
|
|
beyond 60 characters (255 characters would be a good choice).
|
|
</simpara>
|
|
</listitem>
|
|
<listitem>
|
|
<simpara>
|
|
<constant>PASSWORD_BCRYPT</constant> - Use the <constant>CRYPT_BLOWFISH</constant> algorithm to
|
|
create the hash. This will produce a standard <function>crypt</function> compatible hash using
|
|
the "$2y$" identifier. The result will always be a 60 character string, &return.falseforfailure;.
|
|
</simpara>
|
|
</listitem>
|
|
</itemizedlist>
|
|
</para>
|
|
<simpara>
|
|
Supported Options:
|
|
</simpara>
|
|
<para>
|
|
<itemizedlist>
|
|
<listitem>
|
|
<para>
|
|
<literal>salt</literal> - to manually provide a salt to use when hashing the password.
|
|
Note that this will override and prevent a salt from being automatically generated.
|
|
</para>
|
|
<para>
|
|
If omitted, a random salt will be generated by <function>password_hash</function> for
|
|
each password hashed. This is the intended mode of operation.
|
|
</para>
|
|
<warning>
|
|
<para>
|
|
The salt option has been deprecated as of PHP 7.0.0. It is now
|
|
preferred to simply use the salt that is generated by default.
|
|
</para>
|
|
</warning>
|
|
</listitem>
|
|
<listitem>
|
|
<para>
|
|
<literal>cost</literal> - which denotes the algorithmic cost that should be used.
|
|
Examples of these values can be found on the <function>crypt</function> page.
|
|
</para>
|
|
<para>
|
|
If omitted, a default value of <literal>10</literal> will be used. This is a good
|
|
baseline cost, but you may want to consider increasing it depending on your hardware.
|
|
</para>
|
|
</listitem>
|
|
</itemizedlist>
|
|
</para>
|
|
</refsect1>
|
|
|
|
<refsect1 role="parameters">
|
|
&reftitle.parameters;
|
|
<variablelist>
|
|
<varlistentry>
|
|
<term><parameter>password</parameter></term>
|
|
<listitem>
|
|
<para>
|
|
&password.parameter.password;
|
|
</para>
|
|
<caution>
|
|
<para>
|
|
Using the <constant>PASSWORD_BCRYPT</constant> as the
|
|
algorithm, will result
|
|
in the <parameter>password</parameter> parameter being truncated to a
|
|
maximum length of 72 characters.
|
|
</para>
|
|
</caution>
|
|
</listitem>
|
|
</varlistentry>
|
|
<varlistentry>
|
|
<term><parameter>algo</parameter></term>
|
|
<listitem>
|
|
<para>
|
|
&password.parameter.algo;
|
|
</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
<varlistentry>
|
|
<term><parameter>options</parameter></term>
|
|
<listitem>
|
|
<para>
|
|
&password.parameter.options;
|
|
</para>
|
|
<para>
|
|
If omitted, a random salt will be created and the default cost will be
|
|
used.
|
|
</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
</variablelist>
|
|
</refsect1>
|
|
|
|
<refsect1 role="returnvalues">
|
|
&reftitle.returnvalues;
|
|
<para>
|
|
Returns the hashed password, &return.falseforfailure;.
|
|
</para>
|
|
<para>
|
|
The used algorithm, cost and salt are returned as part of the hash. Therefore,
|
|
all information that's needed to verify the hash is included in it. This allows
|
|
the <function>password_verify</function> function to verify the hash without
|
|
needing separate storage for the salt or algorithm information.
|
|
</para>
|
|
</refsect1>
|
|
|
|
<refsect1 role="examples">
|
|
&reftitle.examples;
|
|
<para>
|
|
<example>
|
|
<title><function>password_hash</function> example</title>
|
|
<programlisting role="php">
|
|
<![CDATA[
|
|
<?php
|
|
/**
|
|
* We just want to hash our password using the current DEFAULT algorithm.
|
|
* This is presently BCRYPT, and will produce a 60 character result.
|
|
*
|
|
* Beware that DEFAULT may change over time, so you would want to prepare
|
|
* By allowing your storage to expand past 60 characters (255 would be good)
|
|
*/
|
|
echo password_hash("rasmuslerdorf", PASSWORD_DEFAULT)."\n";
|
|
?>
|
|
]]>
|
|
</programlisting>
|
|
&example.outputs.similar;
|
|
<screen>
|
|
<![CDATA[
|
|
$2y$10$.vGA1O9wmRjrwAVXD98HNOgsNpDczlqm3Jq7KnEd1rVAGv3Fykk1a
|
|
]]>
|
|
</screen>
|
|
</example>
|
|
</para>
|
|
<para>
|
|
<example>
|
|
<title><function>password_hash</function> example setting cost manually</title>
|
|
<programlisting role="php">
|
|
<![CDATA[
|
|
<?php
|
|
/**
|
|
* In this case, we want to increase the default cost for BCRYPT to 12.
|
|
* Note that we also switched to BCRYPT, which will always be 60 characters.
|
|
*/
|
|
$options = [
|
|
'cost' => 12,
|
|
];
|
|
echo password_hash("rasmuslerdorf", PASSWORD_BCRYPT, $options)."\n";
|
|
?>
|
|
]]>
|
|
</programlisting>
|
|
&example.outputs.similar;
|
|
<screen>
|
|
<![CDATA[
|
|
$2y$12$QjSH496pcT5CEbzjD/vtVeH03tfHKFy36d4J0Ltp3lRtee9HDxY3K
|
|
]]>
|
|
</screen>
|
|
</example>
|
|
</para>
|
|
|
|
<para>
|
|
<example>
|
|
<title><function>password_hash</function> example setting salt manually</title>
|
|
<programlisting role="php">
|
|
<![CDATA[
|
|
<?php
|
|
/**
|
|
* Note that the salt here is randomly generated.
|
|
* Never use a static salt or one that is not randomly generated.
|
|
*
|
|
* For the VAST majority of use-cases, let password_hash generate the salt randomly for you
|
|
*/
|
|
$options = [
|
|
'cost' => 11,
|
|
'salt' => mcrypt_create_iv(22, MCRYPT_DEV_URANDOM),
|
|
];
|
|
echo password_hash("rasmuslerdorf", PASSWORD_BCRYPT, $options)."\n";
|
|
?>
|
|
]]>
|
|
</programlisting>
|
|
&example.outputs.similar;
|
|
<screen>
|
|
<![CDATA[
|
|
$2y$11$q5MkhSBtlsJcNEVsYh64a.aCluzHnGog7TQAKVmQwO9C8xb.t89F.
|
|
]]>
|
|
</screen>
|
|
</example>
|
|
</para>
|
|
<para>
|
|
<example>
|
|
<title><function>password_hash</function> example finding a good cost</title>
|
|
<programlisting role="php">
|
|
<![CDATA[
|
|
<?php
|
|
/**
|
|
* This code will benchmark your server to determine how high of a cost you can
|
|
* afford. You want to set the highest cost that you can without slowing down
|
|
* you server too much. 8-10 is a good baseline, and more is good if your servers
|
|
* are fast enough. The code below aims for ≤ 50 milliseconds stretching time,
|
|
* which is a good baseline for systems handling interactive logins.
|
|
*/
|
|
$timeTarget = 0.05; // 50 milliseconds
|
|
|
|
$cost = 8;
|
|
do {
|
|
$cost++;
|
|
$start = microtime(true);
|
|
password_hash("test", PASSWORD_BCRYPT, ["cost" => $cost]);
|
|
$end = microtime(true);
|
|
} while (($end - $start) < $timeTarget);
|
|
|
|
echo "Appropriate Cost Found: " . $cost . "\n";
|
|
?>
|
|
]]>
|
|
</programlisting>
|
|
&example.outputs.similar;
|
|
<screen>
|
|
<![CDATA[
|
|
Appropriate Cost Found: 10
|
|
]]>
|
|
</screen>
|
|
</example>
|
|
</para>
|
|
</refsect1>
|
|
|
|
<refsect1 role="notes">
|
|
&reftitle.notes;
|
|
<caution>
|
|
<para>
|
|
It is strongly recommended that you do not generate your own salt for this
|
|
function. It will create a secure salt automatically for you if you do
|
|
not specify one.
|
|
</para>
|
|
<para>
|
|
As noted above, providing the <literal>salt</literal> option in PHP 7.0
|
|
will generate a deprecation warning. Support for providing a salt manually
|
|
may be removed in a future PHP release.
|
|
</para>
|
|
</caution>
|
|
<note>
|
|
<para>
|
|
It is recommended that you test this function on your servers, and adjust the cost parameter
|
|
so that execution of the function takes less than 100 milliseconds on interactive systems.
|
|
The script in the above example will help you choose a good cost value for your hardware.
|
|
</para>
|
|
</note>
|
|
<note>
|
|
<simpara>
|
|
Updates to supported algorithms by this function (or changes to the default one) must follow
|
|
the following rules:
|
|
</simpara>
|
|
<para>
|
|
<itemizedlist>
|
|
<listitem>
|
|
<simpara>
|
|
Any new algorithm must be in core for at least 1 full release of PHP
|
|
prior to becoming default. So if, for example, a new algorithm is added
|
|
in 7.5.5, it would not be eligible for default until 7.7 (since 7.6
|
|
would be the first full release). But if a different algorithm was added
|
|
in 7.6.0, it would also be eligible for default at 7.7.0.
|
|
</simpara>
|
|
</listitem>
|
|
<listitem>
|
|
<simpara>
|
|
The default should only change in a full release (7.3.0, 8.0.0, etc)
|
|
and not in a revision release. The only exception to this is in an
|
|
emergency when a critical security flaw is found in the current
|
|
default.
|
|
</simpara>
|
|
</listitem>
|
|
</itemizedlist>
|
|
</para>
|
|
</note>
|
|
</refsect1>
|
|
|
|
<refsect1 role="seealso">
|
|
&reftitle.seealso;
|
|
<para>
|
|
<simplelist>
|
|
<member><function>password_verify</function></member>
|
|
<member><function>crypt</function></member>
|
|
<member><link xmlns:xlink="http://www.w3.org/1999/xlink" xlink:href="&url.password.compat;">userland implementation</link></member>
|
|
</simplelist>
|
|
</para>
|
|
</refsect1>
|
|
|
|
</refentry>
|
|
|
|
<!-- Keep this comment at the end of the file
|
|
Local variables:
|
|
mode: sgml
|
|
sgml-omittag:t
|
|
sgml-shorttag:t
|
|
sgml-minimize-attributes:nil
|
|
sgml-always-quote-attributes:t
|
|
sgml-indent-step:1
|
|
sgml-indent-data:t
|
|
indent-tabs-mode:nil
|
|
sgml-parent-document:nil
|
|
sgml-default-dtd-file:"~/.phpdoc/manual.ced"
|
|
sgml-exposed-tags:nil
|
|
sgml-local-catalogs:nil
|
|
sgml-local-ecat-files:nil
|
|
End:
|
|
vim600: syn=xml fen fdm=syntax fdl=2 si
|
|
vim: et tw=78 syn=sgml
|
|
vi: ts=1 sw=1
|
|
-->
|