php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #61852 crypt() function incorrectly falls back to CRYPT_STD_DES
Submitted: 2012-04-25 20:27 UTC Modified: 2020-06-24 12:04 UTC
Votes:1
Avg. Score:5.0 ± 0.0
Reproduced:1 of 1 (100.0%)
Same Version:0 (0.0%)
Same OS:0 (0.0%)
From: rchouinard at gmail dot com Assigned: nikic (profile)
Status: Closed Package: *Encryption and hash functions
PHP Version: 5.3.10 OS: CentOS 5
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: rchouinard at gmail dot com
New email:
PHP Version: OS:

 

 [2012-04-25 20:27 UTC] rchouinard at gmail dot com
Description:
------------
The crypt() method fails bcrypt test vectors given by Openwall's crypt v1.2. 
Specifically, when given an invalid identifier, crypt() falls back to 
CRYPT_STD_DES, even though the first two bytes of the salt do not match the 
documented "./0-9A-Za-z" range for CRYPT_STD_DES. The expected behavior would be 
to return *0.

I've tested this under PHP 5.3.10 on Zend Server on CentOS 5 and Windows 7.

Test script:
---------------
<?php
// Expect *0, returns $2OahnOya9Dwg
echo crypt('', '$2`$05$CCCCCCCCCCCCCCCCCCCCC.') . PHP_EOL;

// Expect *0, returns $2OahnOya9Dwg
echo crypt('', '$2{$05$CCCCCCCCCCCCCCCCCCCCC.') . PHP_EOL;

// Expect *1, returns *0Vh7kctua2ww
echo crypt('', '*0') . PHP_EOL;

Expected result:
----------------
*0
*0
*1


Actual result:
--------------
$2OahnOya9Dwg
$2OahnOya9Dwg
*0Vh7kctua2ww


Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2020-06-24 12:04 UTC] nikic@php.net
-Status: Open +Status: Closed -Assigned To: +Assigned To: nikic
 [2020-06-24 12:04 UTC] nikic@php.net
This has been fixed in PHP 8.0 (though a deprecation warning is already thrown since some earlier version).
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved.
Last updated: Mon Jun 02 13:01:26 2025 UTC