PhpassHashedPassword
class PhpassHashedPassword implements PasswordInterface (View source)
Secure password hashing functions based on the Portable PHP password hashing framework.
Constants
| MIN_HASH_COUNT |
The minimum allowed log2 number of iterations for password stretching. |
| MAX_HASH_COUNT |
The maximum allowed log2 number of iterations for password stretching. |
| HASH_LENGTH |
The expected (and maximum) number of characters in a hashed password. |
Properties
| static string | $ITOA64 | Returns a string for mapping an int to the corresponding base 64 character. |
|
| protected int | $countLog2 | Specifies the number of times the hashing function will be applied when generating new password hashes. The number of times is calculated by raising 2 to the power of the given value. |
Methods
Constructs a new password hashing instance.
Encodes bytes into printable base 64 using the *nix standard from crypt().
Generates a random base 64-encoded salt prefixed with hash settings.
Ensures that $count_log2 is within set bounds.
Hash a password using a secure stretched hash.
Parses the log2 iteration count from a stored hash or setting string.
Hash a password using a secure hash.
Check whether a plain text password matches a hashed password.
Check whether a hashed password needs to be replaced with a new hash.
Details
__construct(int $countLog2)
Constructs a new password hashing instance.
protected string
base64Encode(string $input, int $count)
Encodes bytes into printable base 64 using the *nix standard from crypt().
protected string
generateSalt()
Generates a random base 64-encoded salt prefixed with hash settings.
Proper use of salts may defeat a number of attacks, including:
- The ability to try candidate passwords against multiple hashes at once.
- The ability to use pre-hashed lists of candidate passwords.
- The ability to determine whether two users have the same (or different) password without actually having to guess one of the passwords.
protected int
enforceLog2Boundaries(int $count_log2)
Ensures that $count_log2 is within set bounds.
protected string
crypt(string $algo, string $password, string $setting)
Hash a password using a secure stretched hash.
By using a salt and repeated hashing the password is "stretched". Its security is increased because it becomes much more computationally costly for an attacker to try to break the hash by brute-force computation of the hashes of a large number of plain-text words or strings to find a match.
int
getCountLog2(string $setting)
Parses the log2 iteration count from a stored hash or setting string.
string
hash(string $password)
Hash a password using a secure hash.
bool
check(string $password, string $hash)
Check whether a plain text password matches a hashed password.
bool
needsRehash(string $hash)
Check whether a hashed password needs to be replaced with a new hash.
This is typically called during the login process when the plain text password is available. A new hash is needed when the desired iteration count has changed by a modification of the password-service in the dependency injection container or if the user's password hash was generated in an update like user_update_7000() (see the Drupal 7 documentation).