I am fielding a question for a project that is asking if we use Blowfish crypt in Drupal, or, if we could.
The class that performs password hashing in 8 is
PhpassHashedPassword, based on https://www.openwall.com/phpass/. On that site, it states:
At this time, if your new project can afford to require PHP 5.5+, which it should, please use PHP's native password_hash() / password_verify() API instead of phpass. This new API also happens to support the CRYPT_BLOWFISH and CRYPT_EXT_DES hashes used by phpass, but unfortunately it does not support the phpass portable hashes (which are portable across all versions of PHP as long as you use phpass).
It goes on to state:
The preferred (most secure) hashing method supported by phpass is the OpenBSD-style Blowfish-based bcrypt, also supported with our public domain crypt_blowfish package (for C applications), and known in PHP as CRYPT_BLOWFISH, with a fallback to MD5-based salted and variable iteration count password hashes implemented in phpass itself (also referred to as portable hashes). (phpass versions up to 0.4 also included an intermediary fallback to BSDI-style extended DES-based hashes, known in PHP as CRYPT_EXT_DES, but this has since been dropped except for authenticating against pre-existing hashes of this type.)
When reviewing the class in Drupal 8, it does not make use of
password_verify. It also appears to use
sha512 as the algo. I can't find anywhere if
bcrypt or Blowfish or
CRYPT_BLOWFISH is used.
I did find this issue regarding supporting Blowfish style passwords but not one for creating them. I assume if I wanted to import their current userbase with Blowfish style passwords, I would need this patch.
Would it be difficult to implement my own class to do this that uses Blowfish? Are there any implications in Drupal of doing this? Why did version 8 opt to stick go with
SHA-512? This project will be on PHP 7.2, so I don't care about PHP 5.x BC/reasons/etc.