How to confirm password after encryption - php

Question

So I've managed to encrypt the users password successfully and send it to the DB etc.. I just wanted to know how I would go about decrypting or other methods to check to see if the users input matches the DB password. Everytime the hash is processed a different encrypted password is created.Using PHP 4.3
<form method="post" action="">
<input type="text" name="user" id="user">
<input type="password" name="pass" id="pass">
<input type="submit" name="submit">
</form>
<?php
session_start();
require_once("connection.php");
require_once("passEncrypt.php");
if(isset($_POST["submit"])) {
$user = $_POST["user"];
$password = $_POST["pass"];
$pass = encrypt($password);
echo $pass;
}
?>
<?php
function encrypt($pass){
// use blowfish algorithm 10 times
$hash_format="$2a$10$";
$salt_length=22;
$salt = generate_salt($salt_length);
// store this in DB
$format_and_salt = $hash_format . $salt ;
$hash = crypt($pass, $format_and_salt);
return $hash;
}
function generate_salt($length){
// return 32 character random string
$unique_string = md5(uniqid(mt_rand(), true));
// provides valid characters
$base64_string = base64_encode($unique_string);
// replaces + with .
$mod_base64_string = str_replace('+', '.', $base64_string );
// make string correct length
$salt = substr($mod_base64_string, 0, $length);
return $salt;
}
?>
I realise the data isn't sanitized or the PHP secure etc.. I'm just trying to understand how to do this before I implement the code into my actual page.

Answer 1

First: This is not encryption. Encryption is reversible.
I wouldn't use this code at all:
<?php
function encrypt($pass){
// use blowfish algorithm 10 times # blowfish != bcrypt
$hash_format="$2a$10$";
$salt_length=22;
$salt = generate_salt($salt_length);
// store this in DB
$format_and_salt = $hash_format . $salt ;
$hash = crypt($pass, $format_and_salt);
return $hash;
}
function generate_salt($length){
// return 32 character random string
$unique_string = md5(uniqid(mt_rand(), true)); # Insecure RNG
// provides valid characters
$base64_string = base64_encode($unique_string);
// replaces + with .
$mod_base64_string = str_replace('+', '.', $base64_string );
// make string correct length
$salt = substr($mod_base64_string, 0, $length);
return $salt;
}
Instead, use the password hashing API. No reason to reinvent the wheel here.
$hash = password_hash($yourPassword, PASSWORD_DEFAULT);
if (password_verify($yourPassword, $hash)) {
// Login successful
}
Using PHP 4.3
Don't use PHP 4. If you do, you're totally on your own.