Search code examples
phpcrypt

crypt() breaks when migrating from PHP 5.2 to 5.4

I have a system running on PHP version 5.2.10 Unfortunately the original programmer misunderstood how crypt() was implemented.

$crypt = crypt(trim($cuPassword), CRYPT_BLOWFISH); 
// The programmer thought this is how you configure a blowfish cipher

nb CRYPT_BLOWFISH has a value of zero on this machine.

This works in as much as it produces a random looking password hash eg 0$oZ534I2VvSw

Today, I migrated the software to PHP 5.4.9 and discovered that $crypt becomes *0 , ie an error due to the invalid salt.

My problem is that I have a table of login passwords that I can no longer validate. My question: Is there going to be a way I can recreate the original cipher that ran under version 5.2? What hash was implemented when you passed "0" as a salt?

Solution

  • I tried all valid two digit combinations (CRYPT_STD_DES) and I found that "0q" is equivalent (nearly).

    PHP 5.2.10 crypt(trim($cuPassword), CRYPT_BLOWFISH);

    Result = 0$txv6CWBxJ9Y

    PHP 5.4.9 crypt(trim($cuPassword), '0q');

    Result = 0qtxv6CWBxJ9Y

    All I need to do is adjust the second character and I can match passwords again.