crypt() fallback for old hash salts in PHP7

Viewed 5028

I am working on upgrading my code base to PHP-7 and I'm having trouble with some old users that have a salt format that is not compatible with DES. My idea is to authenticate the user and then transform the hash salt into a new format like Blowfish that is compatible with the new crypt.

The problem comes when I try to use 'crypt()' with the old salt in order to authenticate the user before changing the salt, I get the following error:

crypt(): Supplied salt is not valid for DES. Possible bug in provided salt format.

Is there are way to use crypt (or an alternative function) with other algorithms so I can use the old format salt?

2 Answers

Just one thing you need to have in your mind, password_verify has a specific time to run. If your use is for password, it's highly recommended.

Related