PHP password_verifiy returns true while hash is incorrect

Question

I have the following code with a userpassword contains a blow fish secret and the user password itself.

The hash is another (not the secret and the password!!) but i still got a true as result:

<?php
## password (secret + userpass)
$pass = 'PNvH5GFfUKktXWpydfAMXMYKayjEP3GzfJbaenmzuAHSTv7rQgW8t4ShEKpdcD5nek8eArGQyfz9XRx6ARBc897YVdetest';

## hash
$hash = '$2y$10$9VGEg7HamRVDILsFV5dvJu3l5.Psfk4g6N8.Jcn6/gMhoZIKDLAAm';

## verify
$check = password_verify($pass, $hash);

## check
if(true === $check) {
    
    var_dump($check);
    
} else {
    
    echo "false";
    
}
?>

I have read a lot and think it can be a problem of the length! The algo is limited to 72 chars. For more security, we have a login with a blow fish secret. While hashing, we chain blow fish + userpassword to one big password, then hash it. While login we chain blow fish and userpass again and verify. The result of this is a big password which is hashed in db.

And why do you have the "following code"? What practical value does it have? — Your Common Sense
– Your Common Sense, Commented Aug 22, 2023 at 8:06
Does this answer your question? password_hash returns different value every time — shingo
– shingo, Commented Aug 22, 2023 at 8:07
The code ist an example while i created a login and won't show the whole script. I have read a lot and think it can be a problem of the length! The algo is limited to 72 chars. For more security, we have a login with a blow fish secret. While hashing, we chain blow fish + userpassword to one big password, then hash it. While login we chain blow fish and userpass again and verify. The result of this is a big password which is hashed in db. — marcfunk
– marcfunk, Commented Aug 22, 2023 at 8:13
Did you use password_hash with the PASSWORD_BCRYPT option? As per php.net/manual/en/function.password-hash.php that will indeed truncate the password to 72 characters. Demo: 3v4l.org/Y2pTX . If you want very long passwords, I suggest using a different algorithm which doesn't have this issue. — ADyson
– ADyson, Commented Aug 22, 2023 at 8:20
there is no info about the limit...there is - it's clearly mentioned in php.net/manual/en/… — ADyson
– ADyson, Commented Aug 22, 2023 at 8:31

ADyson · Accepted Answer · 2023-08-22 09:04:56Z

2

Did you use password_hash with the PASSWORD_BCRYPT option (or with PASSWORD_DEFAULT, since Bcrypt is current the default algorithm)? As per the PHP documentation for password_hash that will indeed truncate the password to 72 characters.

Example of the issue:

$pass = 'PNvH5GFfUKktXWpydfAMXMYKayjEP3GzfJbaenmzuAHSTv7rQgW8t4ShEKpdcD5nek8eArGQyfz9XRx6ARBc897YVdetest';
$pass2 = 'PNvH5GFfUKktXWpydfAMXMYKayjEP3GzfJbaenmzuAHSTv7rQgW8t4ShEKpdcD5nek8eArGQ';

$hash = password_hash($pass, PASSWORD_DEFAULT);

echo $hash.PHP_EOL;

var_dump(password_verify($pass2, $hash));

Live demo: https://3v4l.org/Y2pTX .

If you want very long passwords, I suggest using a different algorithm which doesn't have this issue. Either that, or don't use the extra blowfish salt (which shouldn't be necessary), or at least reduce its length.

edited Aug 22, 2023 at 9:04

answered Aug 22, 2023 at 8:29

ADyson

62.9k16 gold badges85 silver badges99 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Khurram Malik Km · Accepted Answer · 2023-08-22 08:18:12Z

-2

Please use password_hash() for generating the hash for the password then use this hash in password_verify() function.

<?PHP
 $pass = "secret_password";

 $hash = password_hash($pass, PASSWORD_DEFAULT); //please use this for generating the hash



## verify
$check = password_verify($pass, $hash);

 ## check
if(true === $check) {

   var_dump($check);

 } else {

    echo "false";

 }

?>

answered Aug 22, 2023 at 8:18

Khurram Malik Km

11 bronze badge

1 Comment

marcfunk Over a year ago

I used this...$cpass = password_hash($bfs.$pass, PASSWORD_DEFAULT); But we still chain al blow fish secret with the userpassword and hash this. And that could be the problem since we are crossing a certain algorithm limit.

Collectives™ on Stack Overflow

PHP password_verifiy returns true while hash is incorrect

2 Answers 2

Comments

1 Comment

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Linked

Related