Storing secure password MD5, BCRYPT, PBKDF2 ( PDO, MySQL, PHP )

Question

What is the best and most secure way of storing a password into MySQL using PHP.

My views as from what I've read online.

MD5 - Outdated and easily breachable. (Example not needed)

BCRYPT - Secure with 60 char, without reusing the salts. ( Unable to find a working example.

PBKDF2 - Most secure way of storing passwords into database. ( example below )

    define("PBKDF2_HASH_ALGORITHM", "sha256");
define("PBKDF2_ITERATIONS", 1000);
define("PBKDF2_SALT_BYTES", 24);
define("PBKDF2_HASH_BYTES", 24);

define("HASH_SECTIONS", 4);
define("HASH_ALGORITHM_INDEX", 0);
define("HASH_ITERATION_INDEX", 1);
define("HASH_SALT_INDEX", 2);
define("HASH_PBKDF2_INDEX", 3);

function create_hash($password){
    // format: algorithm:iterations:salt:hash
    $salt = base64_encode(mcrypt_create_iv(PBKDF2_SALT_BYTES, MCRYPT_DEV_URANDOM));
    return PBKDF2_HASH_ALGORITHM . ":" . PBKDF2_ITERATIONS . ":" .  $salt . ":" .
        base64_encode(pbkdf2(
            PBKDF2_HASH_ALGORITHM,
            $password,
            $salt,
            PBKDF2_ITERATIONS,
            PBKDF2_HASH_BYTES,
            true
        ));
}

function validate_password($password, $good_hash){
    $params = explode(":", $good_hash);
    if(count($params) < HASH_SECTIONS)
       return false;
    $pbkdf2 = base64_decode($params[HASH_PBKDF2_INDEX]);
    return slow_equals(
        $pbkdf2,
        pbkdf2(
            $params[HASH_ALGORITHM_INDEX],
            $password,
            $params[HASH_SALT_INDEX],
            (int)$params[HASH_ITERATION_INDEX],
            strlen($pbkdf2),
            true
        )
    );
}

// Compares two strings $a and $b in length-constant time.
function slow_equals($a, $b){
    $diff = strlen($a) ^ strlen($b);
    for($i = 0; $i < strlen($a) && $i < strlen($b); $i++)
    {
        $diff |= ord($a[$i]) ^ ord($b[$i]);
    }
    return $diff === 0;
}
function pbkdf2($algorithm, $password, $salt, $count, $key_length, $raw_output = false){
    $algorithm = strtolower($algorithm);
    if(!in_array($algorithm, hash_algos(), true))
        die('PBKDF2 ERROR: Invalid hash algorithm.');
    if($count <= 0 || $key_length <= 0)
        die('PBKDF2 ERROR: Invalid parameters.');

    $hash_length = strlen(hash($algorithm, "", true));
    $block_count = ceil($key_length / $hash_length);

    $output = "";
    for($i = 1; $i <= $block_count; $i++) {
        // $i encoded as 4 bytes, big endian.
        $last = $salt . pack("N", $i);
        // first iteration
        $last = $xorsum = hash_hmac($algorithm, $last, $password, true);
        // perform the other $count - 1 iterations
        for ($j = 1; $j < $count; $j++) {
            $xorsum ^= ($last = hash_hmac($algorithm, $last, $password, true));
        }
        $output .= $xorsum;
    }

    if($raw_output)
        return substr($output, 0, $key_length);
    else
        return bin2hex(substr($output, 0, $key_length));
}

possible duplicate of [How can I store my users' passwords safely?](http://stackoverflow.com/questions/1581610/how-can-i-store-my-users-passwords-safely) And a few thousand others — , May 23 '13 at 20:19
It doesn't talk about pbkdf2 at all. and that was three years ago... — iBrazilian2, May 23 '13 at 20:21

score 1 · Answer 1 · answered May 23 '13 at 20:36

1

Take a look at some of @ircmaxell's stuff. Hes got a github repository to add the new password_* functions of php5.5 into lower versions (5.3+)

password_compat

His Blog

answered May 23 '13 at 20:36

Ascherer

8,223
3
42
60

score 0 · Accepted Answer · edited Mar 17 '17 at 13:14

0

There is also an SCRYPT php implementation, which is an advanced version of bcrypt. This post have a good answer on the subject.

edited Mar 17 '17 at 13:14

Community

1
1

answered May 23 '13 at 20:47

Alexander

4,153
1
24
37

Storing secure password MD5, BCRYPT, PBKDF2 ( PDO, MySQL, PHP )

2 Answers2