What is the KEY used in frameworks for?

Question

Generally, when I see systems that have been made without the use of frameworks, there is no use of keys.

However, all the frameworks I have used to date, all of them you need to define a key (key) for your application, for it to work.

An example of this is the Laravel, where you have a configuration similar to this:

  /*
    |--------------------------------------------------------------------------
    | Encryption Key
    |--------------------------------------------------------------------------
    |
    | This key is used by the Illuminate encrypter service and should be set
    | to a random, 32 character string, otherwise these encrypted strings
    | will not be safe. Please do this before deploying an application!
    |
    */

    'key' => 'A5CNJaYsFnpC9jpkbAk1nOI1ETUBsJOP',

What is the point of key generally used in frameworks?

This is related to some security scheme?

Answer 1

Is used to SALT hashing in PHP

The Laravel works on library password_hashfor generating keys protected in passwords.

Check out:

Illuminate\Hashing\BcryptHasher line 30

    public function make($value, array $options = [])
    {
        $cost = isset($options['rounds']) ? $options['rounds'] : $this->rounds;

        $hash = password_hash($value, PASSWORD_BCRYPT, ['cost' => $cost]);

        if ($hash === false) {
            throw new RuntimeException('Bcrypt hashing not supported.');
        }

        return $hash;
    }

This random combination will be the salt for hash generation. Each KEY will always generate a different hash. This prevents them from breaking into your bank and discovering your customers' password. Since in this example you will only have access to the password hash, which is a single-hand hash.

Never let them have access to this key, because it is linked directly to the hashing of your passwords.

But what do you mean? Hashing? Salt? Cost?

Come on, I’m no expert in this sector but I’ll try to help you.

Hashing

Hashing is the method of "hiding" the password or some other "intruder" text. Let’s take for example:

Look at this string:

$2y$10$ZxqbuwvAYAGvhQgl0C9Kh.q.UWCdL1eQg4SMqbrfbvnjX4rOl2AcW

Can you tell what her real value is?

This string is a hash of a password, which in this case is: 102030

My application, with a single SALT generated this string as 102030.

This means password hash 102030 in my application will be the same as yours? No, never. Because KEYS(SALT) are unique.

Salt

salt - to Manually provide a salt to use when hashing the password. Note that this will override and Prevent a salt from being Automatically generated.

Salt is a character combination that will be used as a "key" to hash your strings.

Cost

cost - which denotes the algorithmic cost that should be used. Examples of These values can be found on the crypt() page.

Cost is what the word already says: Cost. When of cost will this hashing have for the processor to be processed? Remembering that: The higher the cost, the lower the chance of someone doing Brute force Attack in your application, BUT your processor will have more work every time someone is typing the password.

Ok, but and how application knows that the user typed the correct password being that it is all "encrypted"?

By comparison method, young.

Let’s start from the example that a password is generated over KEY x with COST 10.

If the user enters password 102030 ALWAYS equal strings will be generated as the key has not changed nor the cost.

So watch out for the KEY of its application, it is important for this safety factor. If anyone finds out you are closer to finding out the passwords in your bank, or if you change it all the passwords in your bank will be invalid.

Correction

Laravel does not use SALT to generate passwords, but uses it for library Encryption which is defined as the key in EncryptionServiceProvider Otherwise it’s the same ideology.