Choice of hash generation method in PHP

Question

My doubt started when I decided to re-examine the method I was using to get the user’s password and store it in the database. After reading that one, that one and that one questions here on the network, in addition to many others on other networks, such as that one and that one, some doubts arose me.

We have old methods, but excellent to the present day, of generating a hash to store in BD. We also have some, which were considered great, but are already falling into disuse (or at least in concept) due to safety, as is the case of md5 and family sha.

We also have new methods where, as far as I read, it seems to be the strongest candidate to be used for the generation of hash, even more recommended than the bcrypt or PBKDF2, which is the case with password_* in the PHP >= 5.5.

---

Some requirements I have observed as ideal in the elaboration of hash would be:

• All hash generated must be created next to a salt;
• All salt generated must be unique per customer;
• The function should be slow, to hinder the attack of brute force;

---

With that in mind, as far as I can consider this thought to be correct and start using only the method password_*? It would fit the ideal requirements for generating hash?

What struck me was also the simplicity in terms of code to use password_*, because with few lines of code we can get the expected result, example:

//Gerar um hash
$salt    = $resultadoSalt; //resultado de uma função para obter o salt único
$options = [
    'cost' => 14,
    'salt' => $salt
];
$hash = password_hash($password, PASSWORD_BCRYPT, $options);

//Validar um hash
if (!password_verify($password, $hash)) return false;

In this case, store the function result password_hash in the Database would be enough? Ex.: $2y$14$5e7b5f0ef3cccfac9b902uR4sHJTlTYv3RYt3ApP7PvyTXHmdhN7e or some other process would be recommended?

Remembering that any other considerations on the subject are welcome!

Answer 1

With that in mind, as far as I can consider this thought as correct and start using only the password_*? method if fit the ideal requirements for hashing?

The purpose of the PHP password API is to repurpose the code. Up to version 7.1 the default algorithm CRYPT_BLOWFISH, but from PHP 7.2 we have a new, safer algorithm called Aragon2 from the libsodium library:

• libsodium as a Extension core
• Inclusion of the Argon2 algorithm (Including the new constant PASSWORD_ARGON2I)

You’ve already pointed out a basic use of the password_hash, but it is recommended to let the function automatically generate the salt for you. Including, from PHP 7 the option to provide a salt custom was discontinued because it allowed developers to use Salts unsafe.

// o cost padrão é 10, aumente caso deseje que o hash seja mais demorado
$options = [
    'cost' => 14,
];

$hash = password_hash($password, PASSWORD_DEFAULT, $options);

Note that I changed the second argument to the constant PASSWORD_DEFAULT. From this it will be possible to use a new algorithm without changing its application. From the hash generated PHP will be able to verify if a password checks from the password_verify:

$hash = '$2y$07$BCryptRequires22Chrcte/VlQH0piJtjXl.0t1XkA8pw9dMXTpOq';

if (password_verify('alguma_senha', $hash)) {
    echo 'Passou!';
} else {
    echo 'Senha incorreta.';
}

When an algorithm change occurs, use the function password_needs_rehash to change your hash to a more secure one. This function can also be used if the cost be increased.

$password = 'alguma_senha';
// $10 é referente ao cost, que nesse caso é 10
$hash = '$2y$10$YCFsG6elYca568hBi2pZ0.3LDL5wjgxct1N8w/oLR/jfHsiQwCqTS';

// Um cost mais alto foi utilizado
$options = ['cost' => 11];

// Verifica a senha com o hash
if (password_verify($password, $hash)) {

    // O Hash é o mais recente com base nas configs passadas?
    // Imagine que o PASSWORD_DEFAULT foi alterado...
    if (password_needs_rehash($hash, PASSWORD_DEFAULT, $options)) {

        // Se sim, crie um novo hash dessa senha
        $newHash = password_hash($password, PASSWORD_DEFAULT, $options);

        // Passos para atualizar o hash no banco
    }

    // Usuário logado
}

Some requirements I have observed as ideal in hashing would be:

• Every generated hash must be created together with a salt;
• All salt generated must be unique per customer;
• The function should be slow, to hinder the attack of brute force;

Observing the requirements, items 1 and 2 are already having a salt generated at random by password_hash if nothing is sent in options.

The third item needs to be evaluated by finding the relationship between a cost that it is time-consuming to break with brute force and the waiting time of a common user in the application. The higher the cost, longer will be to break it, but also do not make your user wait 1 minute to try to login :)

In a brute force attack where the attacker has obtained the hashes from the bank, what will delay his work is the cost defined.

But in the event of a brute force attack from a endpoint external of your site, you can apply some technique of throttling, which consists in slowing down this processing for some requests only without affecting the user experience. This is done by inserting breaks in script execution for a period of a few seconds for incorrect login attempts, causing requests to take longer.

Alternatively, disable the user temporarily and only activate from another contact medium (contact with service desk, confirmation by text or phone, reset password by email, for example).

In short, when working with passwords in PHP use password_* for:

• Simplify your code
• No problems in future migrations
• Possibility to change the encryption engine in the future in a transparent way for the application

Answer 2

I would recommend reading this article: https://crackstation.net/hashing-security.htm#phpsourcecode

I find it interesting to use bcrypt with high cost. It even has an interesting code in php documentation to find an acceptable cost:

/**
 * This code will benchmark your server to determine how high of a cost you can
 * afford. You want to set the highest cost that you can without slowing down
 * you server too much. 8-10 is a good baseline, and more is good if your servers
 * are fast enough. The code below aims for ≤ 50 milliseconds stretching time,
 * which is a good baseline for systems handling interactive logins.
 */
$timeTarget = 0.05; // 50 milliseconds 

$cost = 8;
do {
    $cost++;
    $start = microtime(true);
    password_hash("test", PASSWORD_BCRYPT, ["cost" => $cost]);
    $end = microtime(true);
} while (($end - $start) < $timeTarget);

echo "Appropriate Cost Found: " . $cost . "\n";