4

I am fielding a question for a project that is asking if we use Blowfish crypt in Drupal, or, if we could.

The class that performs password hashing in 8 is PhpassHashedPassword, based on https://www.openwall.com/phpass/. On that site, it states:

At this time, if your new project can afford to require PHP 5.5+, which it should, please use PHP's native password_hash() / password_verify() API instead of phpass. This new API also happens to support the CRYPT_BLOWFISH and CRYPT_EXT_DES hashes used by phpass, but unfortunately it does not support the phpass portable hashes (which are portable across all versions of PHP as long as you use phpass).

It goes on to state:

The preferred (most secure) hashing method supported by phpass is the OpenBSD-style Blowfish-based bcrypt, also supported with our public domain crypt_blowfish package (for C applications), and known in PHP as CRYPT_BLOWFISH, with a fallback to MD5-based salted and variable iteration count password hashes implemented in phpass itself (also referred to as portable hashes). (phpass versions up to 0.4 also included an intermediary fallback to BSDI-style extended DES-based hashes, known in PHP as CRYPT_EXT_DES, but this has since been dropped except for authenticating against pre-existing hashes of this type.)

When reviewing the class in Drupal 8, it does not make use of password_hash, or password_verify. It also appears to use sha512 as the algo. I can't find anywhere if bcrypt or Blowfish or CRYPT_BLOWFISH is used.

I did find this issue regarding supporting Blowfish style passwords but not one for creating them. I assume if I wanted to import their current userbase with Blowfish style passwords, I would need this patch.

Would it be difficult to implement my own class to do this that uses Blowfish? Are there any implications in Drupal of doing this? Why did version 8 opt to stick go with SHA-512? This project will be on PHP 7.2, so I don't care about PHP 5.x BC/reasons/etc.

Potentially related: https://stackoverflow.com/questions/16014282/why-crypt-blowfish-in-php-is-considered-better-when-it-produces-shorter-hashes

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.