PhpassHashedPassword.php 8.46 KB
Newer Older
1 2 3 4
<?php

namespace Drupal\Core\Password;

5 6
use Drupal\Component\Utility\Crypt;

7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41
/**
 * Secure password hashing functions based on the Portable PHP password
 * hashing framework.
 *
 * @see http://www.openwall.com/phpass/
 */
class PhpassHashedPassword implements PasswordInterface {
  /**
   * The minimum allowed log2 number of iterations for password stretching.
   */
  const MIN_HASH_COUNT = 7;

  /**
   * The maximum allowed log2 number of iterations for password stretching.
   */
  const MAX_HASH_COUNT = 30;

  /**
   * The expected (and maximum) number of characters in a hashed password.
   */
  const HASH_LENGTH = 55;

  /**
   * Returns a string for mapping an int to the corresponding base 64 character.
   */
  static $ITOA64 = './0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz';

  /**
   * Specifies the number of times the hashing function will be applied when
   * generating new password hashes. The number of times is calculated by
   * raising 2 to the power of the given value.
   */
  protected $countLog2;

  /**
42
   * Constructs a new password hashing instance.
43 44 45 46 47 48 49 50 51 52 53 54 55
   *
   * @param int $countLog2
   *   Password stretching iteration count. Specifies the number of times the
   *   hashing function will be applied when generating new password hashes.
   *   The number of times is calculated by raising 2 to the power of the given
   *   value.
   */
  function __construct($countLog2) {
    // Ensure that $countLog2 is within set bounds.
    $this->countLog2 = $this->enforceLog2Boundaries($countLog2);
  }

  /**
56
   * Encodes bytes into printable base 64 using the *nix standard from crypt().
57
   *
58
   * @param string $input
59
   *   The string containing bytes to encode.
60
   * @param int $count
61 62
   *   The number of characters (bytes) to encode.
   *
63 64
   * @return string
   *   Encoded string.
65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92
   */
  protected function base64Encode($input, $count) {
    $output = '';
    $i = 0;
    do {
      $value = ord($input[$i++]);
      $output .= static::$ITOA64[$value & 0x3f];
      if ($i < $count) {
        $value |= ord($input[$i]) << 8;
      }
      $output .= static::$ITOA64[($value >> 6) & 0x3f];
      if ($i++ >= $count) {
        break;
      }
      if ($i < $count) {
        $value |= ord($input[$i]) << 16;
      }
      $output .= static::$ITOA64[($value >> 12) & 0x3f];
      if ($i++ >= $count) {
        break;
      }
      $output .= static::$ITOA64[($value >> 18) & 0x3f];
    } while ($i < $count);

    return $output;
  }

  /**
93
   * Generates a random base 64-encoded salt prefixed with hash settings.
94 95 96 97 98 99 100
   *
   * Proper use of salts may defeat a number of attacks, including:
   *  - The ability to try candidate passwords against multiple hashes at once.
   *  - The ability to use pre-hashed lists of candidate passwords.
   *  - The ability to determine whether two users have the same (or different)
   *    password without actually having to guess one of the passwords.
   *
101
   * @return string
102 103 104 105 106 107 108
   *   A 12 character string containing the iteration count and a random salt.
   */
  protected function generateSalt() {
    $output = '$S$';
    // We encode the final log2 iteration count in base 64.
    $output .= static::$ITOA64[$this->countLog2];
    // 6 bytes is the standard salt for a portable phpass hash.
109
    $output .= $this->base64Encode(Crypt::randomBytes(6), 6);
110 111 112 113 114 115
    return $output;
  }

  /**
   * Ensures that $count_log2 is within set bounds.
   *
116
   * @param int $count_log2
117 118 119
   *   Integer that determines the number of iterations used in the hashing
   *   process. A larger value is more secure, but takes more time to complete.
   *
120
   * @return int
121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141
   *   Integer within set bounds that is closest to $count_log2.
   */
  protected function enforceLog2Boundaries($count_log2) {
    if ($count_log2 < static::MIN_HASH_COUNT) {
      return static::MIN_HASH_COUNT;
    }
    elseif ($count_log2 > static::MAX_HASH_COUNT) {
      return static::MAX_HASH_COUNT;
    }

    return (int) $count_log2;
  }

  /**
   * Hash a password using a secure stretched hash.
   *
   * By using a salt and repeated hashing the password is "stretched". Its
   * security is increased because it becomes much more computationally costly
   * for an attacker to try to break the hash by brute-force computation of the
   * hashes of a large number of plain-text words or strings to find a match.
   *
142
   * @param string $algo
143
   *   The string name of a hashing algorithm usable by hash(), like 'sha256'.
144
   * @param string $password
145 146
   *   Plain-text password up to 512 bytes (128 to 512 UTF-8 characters) to
   *   hash.
147 148 149
   * @param string $setting
   *   An existing hash or the output of $this->generateSalt(). Must be at least
   *   12 characters (the settings and salt).
150
   *
151
   * @return string
152 153 154 155
   *   A string containing the hashed password (and salt) or FALSE on failure.
   *   The return string will be truncated at HASH_LENGTH characters max.
   */
  protected function crypt($algo, $password, $setting) {
156
    // Prevent DoS attacks by refusing to hash large passwords.
157
    if (strlen($password) > PasswordInterface::PASSWORD_MAX_LENGTH) {
158 159 160
      return FALSE;
    }

161 162 163 164 165 166 167 168
    // The first 12 characters of an existing hash are its setting string.
    $setting = substr($setting, 0, 12);

    if ($setting[0] != '$' || $setting[2] != '$') {
      return FALSE;
    }
    $count_log2 = $this->getCountLog2($setting);
    // Stored hashes may have been crypted with any iteration count. However we
169 170
    // do not allow applying the algorithm for unreasonable low and high values
    // respectively.
171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189
    if ($count_log2 != $this->enforceLog2Boundaries($count_log2)) {
      return FALSE;
    }
    $salt = substr($setting, 4, 8);
    // Hashes must have an 8 character salt.
    if (strlen($salt) != 8) {
      return FALSE;
    }

    // Convert the base 2 logarithm into an integer.
    $count = 1 << $count_log2;

    // We rely on the hash() function being available in PHP 5.2+.
    $hash = hash($algo, $salt . $password, TRUE);
    do {
      $hash = hash($algo, $hash . $password, TRUE);
    } while (--$count);

    $len = strlen($hash);
190
    $output = $setting . $this->base64Encode($hash, $len);
191 192 193 194 195 196 197
    // $this->base64Encode() of a 16 byte MD5 will always be 22 characters.
    // $this->base64Encode() of a 64 byte sha512 will always be 86 characters.
    $expected = 12 + ceil((8 * $len) / 6);
    return (strlen($output) == $expected) ? substr($output, 0, static::HASH_LENGTH) : FALSE;
  }

  /**
198
   * Parses the log2 iteration count from a stored hash or setting string.
199
   *
200 201 202 203 204 205
   * @param string $setting
   *   An existing hash or the output of $this->generateSalt(). Must be at least
   *   12 characters (the settings and salt).
   *
   * @return int
   *   The log2 iteration count.
206 207 208 209 210 211
   */
  public function getCountLog2($setting) {
    return strpos(static::$ITOA64, $setting[3]);
  }

  /**
212
   * {@inheritdoc}
213 214 215 216 217 218
   */
  public function hash($password) {
    return $this->crypt('sha512', $password, $this->generateSalt());
  }

  /**
219
   * {@inheritdoc}
220
   */
221 222
  public function check($password, $hash) {
    if (substr($hash, 0, 2) == 'U$') {
223 224 225
      // This may be an updated password from user_update_7000(). Such hashes
      // have 'U' added as the first character and need an extra md5() (see the
      // Drupal 7 documentation).
226
      $stored_hash = substr($hash, 1);
227 228 229
      $password = md5($password);
    }
    else {
230
      $stored_hash = $hash;
231 232 233 234 235 236
    }

    $type = substr($stored_hash, 0, 3);
    switch ($type) {
      case '$S$':
        // A normal Drupal 7 password using sha512.
237
        $computed_hash = $this->crypt('sha512', $password, $stored_hash);
238 239 240 241 242 243
        break;
      case '$H$':
        // phpBB3 uses "$H$" for the same thing as "$P$".
      case '$P$':
        // A phpass password generated using md5.  This is an
        // imported password or from an earlier Drupal version.
244
        $computed_hash = $this->crypt('md5', $password, $stored_hash);
245 246 247 248
        break;
      default:
        return FALSE;
    }
249 250 251

    // Compare using hashEquals() instead of === to mitigate timing attacks.
    return $computed_hash && Crypt::hashEquals($stored_hash, $computed_hash);
252 253 254
  }

  /**
255
   * {@inheritdoc}
256
   */
257
  public function needsRehash($hash) {
258
    // Check whether this was an updated password.
259
    if ((substr($hash, 0, 3) != '$S$') || (strlen($hash) != static::HASH_LENGTH)) {
260 261 262 263 264
      return TRUE;
    }
    // Ensure that $count_log2 is within set bounds.
    $count_log2 = $this->enforceLog2Boundaries($this->countLog2);
    // Check whether the iteration count used differs from the standard number.
265
    return ($this->getCountLog2($hash) !== $count_log2);
266
  }
267

268
}