Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:103328
MIME-Version: 1.0
References: <CAESVnVq-oQreEyNDQZPWJ+fxuXs_66WWBTywRii7AFEFjqxBNQ@mail.gmail.com>
 <CALKiJKrhB9pKtdF=PdBwrJB-81QLCGtr1TKF6rQ0p8XtGhFrrA@mail.gmail.com>
 <CAESVnVpXjvR2-3n6AdSA+TwzsGEEeAD0L2dH18wiDtHnwE7uHA@mail.gmail.com>
 <CALKiJKqxgFd=fQvapDrX3tJLtuEkEXk-qHwv=XrNfM5OURROHg@mail.gmail.com> <CAESVnVq6xDk1CmVvHNCcxyLQMmDz3CnqGBvNDJDdZYzTaVZJvQ@mail.gmail.com>
In-Reply-To: <CAESVnVq6xDk1CmVvHNCcxyLQMmDz3CnqGBvNDJDdZYzTaVZJvQ@mail.gmail.com>
Date: Thu, 18 Oct 2018 15:16:01 +0100
Message-ID: <CALKiJKqcQxFYD883UvAmt=n+HvXTehDPjJcp_G1DQ2GFtRC_kw@mail.gmail.com>
To: Sara Golemon <pollita@php.net>
Cc: PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="000000000000e021d80578816d54"
Subject: Re: [PHP-DEV] Password Digest Registry
From: rowan.collins@gmail.com (Rowan Collins)

--000000000000e021d80578816d54
Content-Type: text/plain; charset="UTF-8"

On Thu, 18 Oct 2018 at 14:55, Sara Golemon <pollita@php.net> wrote:

> Unfortunately, I just sat down to implement it and noticed that we
> have explicit test cases which verify that only hashes with a prefix
> of "$2y" *and* a length of precisely 60 are identified as bcrypt.  So
> either we need to loosen that check (I'm trying to avoid BC breaks
> here), or we create additional identification logic.
>

Hm... what does length != 60 currently generate - presumably it's just an
"unrecognised format" error of some sort?

If so, we could keep BC by having a validate method in each handler, but
only call it for hashes with the given prefix, and return an error if it
returns false.

So in PHP terms:

$prefix = extract_prefix($hash);
$handler = $registry[$prefix];
if ( is_null($handler) || ! $handler->validate($hash) ) {
    throw new UnrecognisedHashError;
}

This would also allow handlers to reject other invalid strings, such as
$knownAlgo$nonExistentOption=error$abc123

Regards,
-- 
Rowan Collins
[IMSoP]

--000000000000e021d80578816d54--