Search code examples
yii2cryptphp-7

crypt() fallback for old hash salts in PHP7


I am working on upgrading my code base to PHP-7 and I'm having trouble with some old users that have a salt format that is not compatible with DES. My idea is to authenticate the user and then transform the hash salt into a new format like Blowfish that is compatible with the new crypt.

The problem comes when I try to use 'crypt()' with the old salt in order to authenticate the user before changing the salt, I get the following error:

crypt(): Supplied salt is not valid for DES. Possible bug in provided salt format.

Is there are way to use crypt (or an alternative function) with other algorithms so I can use the old format salt?


Solution

  • For the people that have the same problem, I solved it using password_verify that actually underneath uses password_hashwhich supports existing password hashes as Joachim suggested.