How to migrate from sha256 encryption to bcrypt for PHP?
3
For Login :
$rows = $sql->fetch(PDO::FETCH_ASSOC);
$us_id = $rows['id'];
$us_pass = $rows['password'];
$us_salt = $rows['password_salt'];
$status = $rows['attempt'];
$saltedPass = hash('sha256', "{$password}{$this->passwordSalt}{$us_salt}");
For Register :
$randomSalt = $this->rand_string(20);
$saltedPass = hash('sha256', "{$password}{$this->passwordSalt}{$randomSalt}");
How can this sha256 encryption method be converted to bcrypt?
php encryption
edited Nov 12 '18 at 21:57
Grokify
7,25822337
asked Jun 19 '15 at 14:11
Abhay NaikAbhay Naik
1971214
add a comment |
3
For Login :
$rows = $sql->fetch(PDO::FETCH_ASSOC);
$us_id = $rows['id'];
$us_pass = $rows['password'];
$us_salt = $rows['password_salt'];
$status = $rows['attempt'];
$saltedPass = hash('sha256', "{$password}{$this->passwordSalt}{$us_salt}");
For Register :
$randomSalt = $this->rand_string(20);
$saltedPass = hash('sha256', "{$password}{$this->passwordSalt}{$randomSalt}");
How can this sha256 encryption method be converted to bcrypt?
php encryption
edited Nov 12 '18 at 21:57
Grokify
7,25822337
asked Jun 19 '15 at 14:11
Abhay NaikAbhay Naik
1971214
You really shouldn't use your own salts on password hashes and you really should use PHP's built-in functions to handle password security.
– Jay Blanchard
Jun 19 '15 at 14:13
Actually , I have used bcrypt in my mobile application. Hence I want to change my web application's encryption as I am sharing the database. How could that help me?
– Abhay Naik
Jun 19 '15 at 14:15
add a comment |
3
3
3
For Login :
$rows = $sql->fetch(PDO::FETCH_ASSOC);
$us_id = $rows['id'];
$us_pass = $rows['password'];
$us_salt = $rows['password_salt'];
$status = $rows['attempt'];
$saltedPass = hash('sha256', "{$password}{$this->passwordSalt}{$us_salt}");
For Register :
$randomSalt = $this->rand_string(20);
$saltedPass = hash('sha256', "{$password}{$this->passwordSalt}{$randomSalt}");
How can this sha256 encryption method be converted to bcrypt?
php encryption
edited Nov 12 '18 at 21:57
Grokify
7,25822337
asked Jun 19 '15 at 14:11
Abhay NaikAbhay Naik
1971214
For Login :
$rows = $sql->fetch(PDO::FETCH_ASSOC);
$us_id = $rows['id'];
$us_pass = $rows['password'];
$us_salt = $rows['password_salt'];
$status = $rows['attempt'];
$saltedPass = hash('sha256', "{$password}{$this->passwordSalt}{$us_salt}");
For Register :
$randomSalt = $this->rand_string(20);
$saltedPass = hash('sha256', "{$password}{$this->passwordSalt}{$randomSalt}");
How can this sha256 encryption method be converted to bcrypt?
php encryption
php encryption
edited Nov 12 '18 at 21:57
Grokify
7,25822337
asked Jun 19 '15 at 14:11
Abhay NaikAbhay Naik
1971214
edited Nov 12 '18 at 21:57
Grokify
7,25822337
asked Jun 19 '15 at 14:11
Abhay NaikAbhay Naik
1971214
edited Nov 12 '18 at 21:57
Grokify
7,25822337
edited Nov 12 '18 at 21:57
Grokify
7,25822337
edited Nov 12 '18 at 21:57
Grokify
7,25822337
7,25822337
asked Jun 19 '15 at 14:11
Abhay NaikAbhay Naik
1971214
asked Jun 19 '15 at 14:11
Abhay NaikAbhay Naik
1971214
asked Jun 19 '15 at 14:11
Abhay NaikAbhay Naik
1971214
1971214
You really shouldn't use your own salts on password hashes and you really should use PHP's built-in functions to handle password security.
– Jay Blanchard
Jun 19 '15 at 14:13
Actually , I have used bcrypt in my mobile application. Hence I want to change my web application's encryption as I am sharing the database. How could that help me?
– Abhay Naik
Jun 19 '15 at 14:15
add a comment |
You really shouldn't use your own salts on password hashes and you really should use PHP's built-in functions to handle password security.
– Jay Blanchard
Jun 19 '15 at 14:13
Actually , I have used bcrypt in my mobile application. Hence I want to change my web application's encryption as I am sharing the database. How could that help me?
– Abhay Naik
Jun 19 '15 at 14:15
You really shouldn't use your own salts on password hashes and you really should use PHP's built-in functions to handle password security.
– Jay Blanchard
Jun 19 '15 at 14:13
You really shouldn't use your own salts on password hashes and you really should use PHP's built-in functions to handle password security.
– Jay Blanchard
Jun 19 '15 at 14:13
Actually , I have used bcrypt in my mobile application. Hence I want to change my web application's encryption as I am sharing the database. How could that help me?
– Abhay Naik
Jun 19 '15 at 14:15
Actually , I have used bcrypt in my mobile application. Hence I want to change my web application's encryption as I am sharing the database. How could that help me?
– Abhay Naik
Jun 19 '15 at 14:15
add a comment |
1 Answer
1
active
oldest
votes
2
Password Hashing Using bcrypt
If you are using PHP 5.5 or later, you can use the built-in password_hash() function with the $algo parameter set to PASSWORD_BCRYPT to create bcrypt hashes. You can use this as so:
$options = array('cost' => 11, 'salt' => 'my_salt');
$hash = password_hash("my_secret_password", PASSWORD_BCRYPT, $options);
Migration
It's not possible to do a bulk migration from sha256 to bcrypt because you need the original plaintext data (password) which isn't available.
Typically, sites do a staged conversion where you convert users as they perform successful logins. For example:
- create a field in your database for password has type, sha256 or bcrypt
- upon login, verify the password using the type in the database
- if sha256 and successful, create a new bcrypt entry using the entered password, store that and update the password type to bcrypt. On the next login, bcrypt will now be used for verification.
answered Jun 19 '15 at 14:17
GrokifyGrokify
7,25822337
I just wanted to change those above lines . Those are the only two lines which are sha256 . So is there any way that I can change those lines?
– Abhay Naik
Jun 19 '15 at 14:26
If you are on PHP 5.5 or later, you can use thepassword_hash()function with thePASSWORD_BCRYPToption. I've added this to the answer above. Are you on PHP 5.5 or later?
– Grokify
Jun 19 '15 at 14:34
Yes, I am using PHP 5.5.
– Abhay Naik
Jun 19 '15 at 14:37
yes I will try this. Thank You.
– Abhay Naik
Jun 19 '15 at 14:39
You should not be generating your own salt. Letpassword_hash()generate the salt for you. It uses a CSPRNG.
– Scott Arciszewski
Jun 21 '15 at 5:24
add a comment |
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
draft saved
draft discarded
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f30940324%2fhow-to-migrate-from-sha256-encryption-to-bcrypt-for-php%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
2
Password Hashing Using bcrypt
If you are using PHP 5.5 or later, you can use the built-in password_hash() function with the $algo parameter set to PASSWORD_BCRYPT to create bcrypt hashes. You can use this as so:
$options = array('cost' => 11, 'salt' => 'my_salt');
$hash = password_hash("my_secret_password", PASSWORD_BCRYPT, $options);
Migration
It's not possible to do a bulk migration from sha256 to bcrypt because you need the original plaintext data (password) which isn't available.
Typically, sites do a staged conversion where you convert users as they perform successful logins. For example:
- create a field in your database for password has type, sha256 or bcrypt
- upon login, verify the password using the type in the database
- if sha256 and successful, create a new bcrypt entry using the entered password, store that and update the password type to bcrypt. On the next login, bcrypt will now be used for verification.
answered Jun 19 '15 at 14:17
GrokifyGrokify
7,25822337
I just wanted to change those above lines . Those are the only two lines which are sha256 . So is there any way that I can change those lines?
– Abhay Naik
Jun 19 '15 at 14:26
If you are on PHP 5.5 or later, you can use thepassword_hash()function with thePASSWORD_BCRYPToption. I've added this to the answer above. Are you on PHP 5.5 or later?
– Grokify
Jun 19 '15 at 14:34
Yes, I am using PHP 5.5.
– Abhay Naik
Jun 19 '15 at 14:37
yes I will try this. Thank You.
– Abhay Naik
Jun 19 '15 at 14:39
You should not be generating your own salt. Letpassword_hash()generate the salt for you. It uses a CSPRNG.
– Scott Arciszewski
Jun 21 '15 at 5:24
add a comment |
2
Password Hashing Using bcrypt
If you are using PHP 5.5 or later, you can use the built-in password_hash() function with the $algo parameter set to PASSWORD_BCRYPT to create bcrypt hashes. You can use this as so:
$options = array('cost' => 11, 'salt' => 'my_salt');
$hash = password_hash("my_secret_password", PASSWORD_BCRYPT, $options);
Migration
It's not possible to do a bulk migration from sha256 to bcrypt because you need the original plaintext data (password) which isn't available.
Typically, sites do a staged conversion where you convert users as they perform successful logins. For example:
- create a field in your database for password has type, sha256 or bcrypt
- upon login, verify the password using the type in the database
- if sha256 and successful, create a new bcrypt entry using the entered password, store that and update the password type to bcrypt. On the next login, bcrypt will now be used for verification.
answered Jun 19 '15 at 14:17
GrokifyGrokify
7,25822337
I just wanted to change those above lines . Those are the only two lines which are sha256 . So is there any way that I can change those lines?
– Abhay Naik
Jun 19 '15 at 14:26
If you are on PHP 5.5 or later, you can use thepassword_hash()function with thePASSWORD_BCRYPToption. I've added this to the answer above. Are you on PHP 5.5 or later?
– Grokify
Jun 19 '15 at 14:34
Yes, I am using PHP 5.5.
– Abhay Naik
Jun 19 '15 at 14:37
yes I will try this. Thank You.
– Abhay Naik
Jun 19 '15 at 14:39
You should not be generating your own salt. Letpassword_hash()generate the salt for you. It uses a CSPRNG.
– Scott Arciszewski
Jun 21 '15 at 5:24
add a comment |
2
2
2
Password Hashing Using bcrypt
If you are using PHP 5.5 or later, you can use the built-in password_hash() function with the $algo parameter set to PASSWORD_BCRYPT to create bcrypt hashes. You can use this as so:
$options = array('cost' => 11, 'salt' => 'my_salt');
$hash = password_hash("my_secret_password", PASSWORD_BCRYPT, $options);
Migration
It's not possible to do a bulk migration from sha256 to bcrypt because you need the original plaintext data (password) which isn't available.
Typically, sites do a staged conversion where you convert users as they perform successful logins. For example:
- create a field in your database for password has type, sha256 or bcrypt
- upon login, verify the password using the type in the database
- if sha256 and successful, create a new bcrypt entry using the entered password, store that and update the password type to bcrypt. On the next login, bcrypt will now be used for verification.
answered Jun 19 '15 at 14:17
GrokifyGrokify
7,25822337
Password Hashing Using bcrypt
If you are using PHP 5.5 or later, you can use the built-in password_hash() function with the $algo parameter set to PASSWORD_BCRYPT to create bcrypt hashes. You can use this as so:
$options = array('cost' => 11, 'salt' => 'my_salt');
$hash = password_hash("my_secret_password", PASSWORD_BCRYPT, $options);
Migration
It's not possible to do a bulk migration from sha256 to bcrypt because you need the original plaintext data (password) which isn't available.
Typically, sites do a staged conversion where you convert users as they perform successful logins. For example:
- create a field in your database for password has type, sha256 or bcrypt
- upon login, verify the password using the type in the database
- if sha256 and successful, create a new bcrypt entry using the entered password, store that and update the password type to bcrypt. On the next login, bcrypt will now be used for verification.
answered Jun 19 '15 at 14:17
GrokifyGrokify
7,25822337
edited Jun 19 '15 at 14:37
answered Jun 19 '15 at 14:17
GrokifyGrokify
7,25822337
answered Jun 19 '15 at 14:17
GrokifyGrokify
7,25822337
answered Jun 19 '15 at 14:17
GrokifyGrokify
7,25822337
7,25822337
I just wanted to change those above lines . Those are the only two lines which are sha256 . So is there any way that I can change those lines?
– Abhay Naik
Jun 19 '15 at 14:26
If you are on PHP 5.5 or later, you can use thepassword_hash()function with thePASSWORD_BCRYPToption. I've added this to the answer above. Are you on PHP 5.5 or later?
– Grokify
Jun 19 '15 at 14:34
Yes, I am using PHP 5.5.
– Abhay Naik
Jun 19 '15 at 14:37
yes I will try this. Thank You.
– Abhay Naik
Jun 19 '15 at 14:39
You should not be generating your own salt. Letpassword_hash()generate the salt for you. It uses a CSPRNG.
– Scott Arciszewski
Jun 21 '15 at 5:24
add a comment |
I just wanted to change those above lines . Those are the only two lines which are sha256 . So is there any way that I can change those lines?
– Abhay Naik
Jun 19 '15 at 14:26
If you are on PHP 5.5 or later, you can use thepassword_hash()function with thePASSWORD_BCRYPToption. I've added this to the answer above. Are you on PHP 5.5 or later?
– Grokify
Jun 19 '15 at 14:34
Yes, I am using PHP 5.5.
– Abhay Naik
Jun 19 '15 at 14:37
yes I will try this. Thank You.
– Abhay Naik
Jun 19 '15 at 14:39
You should not be generating your own salt. Letpassword_hash()generate the salt for you. It uses a CSPRNG.
– Scott Arciszewski
Jun 21 '15 at 5:24
I just wanted to change those above lines . Those are the only two lines which are sha256 . So is there any way that I can change those lines?
– Abhay Naik
Jun 19 '15 at 14:26
I just wanted to change those above lines . Those are the only two lines which are sha256 . So is there any way that I can change those lines?
– Abhay Naik
Jun 19 '15 at 14:26
If you are on PHP 5.5 or later, you can use the
password_hash() function with the PASSWORD_BCRYPT option. I've added this to the answer above. Are you on PHP 5.5 or later?– Grokify
Jun 19 '15 at 14:34
If you are on PHP 5.5 or later, you can use the
password_hash() function with the PASSWORD_BCRYPT option. I've added this to the answer above. Are you on PHP 5.5 or later?– Grokify
Jun 19 '15 at 14:34
Yes, I am using PHP 5.5.
– Abhay Naik
Jun 19 '15 at 14:37
Yes, I am using PHP 5.5.
– Abhay Naik
Jun 19 '15 at 14:37
yes I will try this. Thank You.
– Abhay Naik
Jun 19 '15 at 14:39
yes I will try this. Thank You.
– Abhay Naik
Jun 19 '15 at 14:39
You should not be generating your own salt. Let
password_hash() generate the salt for you. It uses a CSPRNG.– Scott Arciszewski
Jun 21 '15 at 5:24
You should not be generating your own salt. Let
password_hash() generate the salt for you. It uses a CSPRNG.– Scott Arciszewski
Jun 21 '15 at 5:24
add a comment |
draft saved
draft discarded
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Some of your past answers have not been well-received, and you're in danger of being blocked from answering.
Please pay close attention to the following guidance:
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
draft saved
draft discarded
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f30940324%2fhow-to-migrate-from-sha256-encryption-to-bcrypt-for-php%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
You really shouldn't use your own salts on password hashes and you really should use PHP's built-in functions to handle password security.
– Jay Blanchard
Jun 19 '15 at 14:13
Actually , I have used bcrypt in my mobile application. Hence I want to change my web application's encryption as I am sharing the database. How could that help me?
– Abhay Naik
Jun 19 '15 at 14:15