PHP PBKDF2+sha512

This topic created in 3860 days ago, the information mentioned may be changed or developed.

并没有什么卵用，都知道该咋用
我就发着玩 2333333

<?php
function password($password,$salt='') {
    if (!$salt)
        $salt = mcrypt_create_iv(16,MCRYPT_DEV_URANDOM);
    $password = hash_pbkdf2("sha512",$password,$salt,10000);
    return sprintf('sha512$10000$%s$%s',base64_encode($salt),$password);
}

function verify($password,$hash) {
    list($algo,$iterations,$salt,$verify) = explode('$',$hash);
    return explode('$',password($password,base64_decode($salt)))[3] === $verify;
}

$password = password('password');
var_dump($password);
// "sha512$10000$LbcjzVgnLQ/Pg+vPMySCoA==$a89c104f76595bdce5677c8f2f3209207493e8c47abe3dffcfdf37c217c7544dbcca079a36f379d5e495cb73d53a99e86da22132ead0df6d94ef4660af17ba6a

var_dump(verify('password',$password));
// bool(true)

iterations 到 100000 次也就 0.1s 左右一般

那么问题来了。不考虑计算成本的前提下，pbkdf2 bcrypt scrypt哪种方法更适合作为生产环境大规模应用的用户密码加密方法？

Supplement 1 · Oct 21, 2015

PHP BCRYPT

```php
password_hash('password_string', PASSWORD_BCRYPT, ['cost'=>12])
```

PHP SCRYPT
https://github.com/DomBlack/php-scrypt

PHP Crypto Library
https://github.com/vinpel/php-Crypto

12 replies • 2015-10-20 20:36:47 +08:00