Download the PHP package pimenvibritania/password-stretcher without Composer
On this page you can find all versions of the php package pimenvibritania/password-stretcher. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Download pimenvibritania/password-stretcher
More information about pimenvibritania/password-stretcher
Files in pimenvibritania/password-stretcher
Package password-stretcher
Short Description Passwords are "hashed" with PBKDF2
License
Homepage https://github.com/pimenvibritania/password-stretcher
FAQ
Example:
In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
- Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
- To use Composer is sometimes complicated. Especially for beginners.
- Composer needs much resources. Sometimes they are not available on a simple webspace.
- If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
- Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Informations about the package password-stretcher
Password Stretcher PBKDF2
Passwords are "hashed" with PBKDF2 (64,000 iterations of SHA1 by default) using a cryptographically-random salt.
Usage
To create a hash, when a new account is added to your system, you call the
CreateHash() method provided by this library. To verify a password, you call
VerifyPassword() method provided by this library.
Customization
Each implementation provides several constants that can be changed. Only change these if you know what you are doing, and have help from an expert:
-
PBKDF2_HASH_ALGORITHM: The hash function PBKDF2 uses. By default, it is SHA1 for compatibility across implementations, but you may change it to SHA256 if you don't care about compatibility. Although SHA1 has been cryptographically broken as a collision-resistant function, it is still perfectly safe for password storage with PBKDF2. -
PBKDF2_ITERATIONS: The number of PBKDF2 iterations. By default, it is 32,000. To provide greater protection of passwords, at the expense of needing more processing power to validate passwords, increase the number of iterations. The number of iterations should not be decreased. -
PBKDF2_SALT_BYTES: The number of bytes of salt. By default, 24 bytes, which is 192 bits. This is more than enough. This constant should not be changed. PBKDF2_HASH_BYTES: The number of PBKDF2 output bytes. By default, 18 bytes, which is 144 bits. While it may seem useful to increase the number of output bytes, doing so can actually give an advantage to the attacker, as it introduces unnecessary (avoidable) slowness to the PBKDF2 computation. 144 bits was chosen because it is (1) Less than SHA1's 160-bit output (to avoid unnecessary PBKDF2 overhead), and (2) A multiple of 6 bits, so that the base64 encoding is optimal.
Note that these constants are encoded into the hash string when it is created
with CreateHash so that they can be changed without breaking existing hashes.
The new (changed) values will apply only to newly-created hashes.
Hash Format
The hash format is five fields separated by the colon (':') character.
Where:
algorithmis the name of the cryptographic hash function ("sha1").iterationsis the number of PBKDF2 iterations ("64000").hashSizeis the length, in bytes, of thehashfield (after decoding).saltis the salt, base64 encoded.hashis the PBKDF2 output, base64 encoded. It must encodehashSizebytes.
Here are some example hashes (all of the password "foobar"):
More Information
For more information on secure password storage, see Crackstation's page on Password Hashing Security.
