Description:
------------
---
From manual page: http://www.php.net/function.crypt#refsect1-function.crypt-description
---

The PHP documentation states that crypt() will "return a failure" if the salt contains an invalid character. For CRYPT_DES, the character "$" (ie, dollar-sign) is not listed as a valid character. However, an input salt with the "$" character still results in valid CRYPT_DES hash output instead of a failure. The documentation and the function's behavior are inconsistent.

Note that the glibc crypt() function fails when "$" is provided, so the documentation is probably correct and it is probably the implementation that is at fault.

Note that allowing "$" for CRYPT_DES has an interesting security implication: Since other hash algorithm salt formats begin with "$", a mistake on the programmer's part in selecting the desired hash algorithm can cause a silent downgrade to the undesirable hash algorithm CRYPT_DES. Examples:

* Valid salt strings for unsupported salt algorithms may get downgraded to CRYPT_DES. For example, in PHP 5.2 (pre-CRYPT_BLOW_FISH support) the CRYPT_BLOWFISH salt string '$2a$abcdefghijklmnopqrstuv' will be silently downgraded to CRYPT_DES.

* An invalid salt string for another algorithm may get downgraded to CRYPT_DES. For example the attempted CRYPT_SHA256 string '$6 $1234567890123456789012345678901234567890123' (notice the space) will get downgraded to CRYPT_DES.

This downgrade will only be caught by the programmer comparing output format and length to the expected format. Since the documentation says CRYPT_DES will return a failure on a salt with a "$", the programmer could be led astray and not thoroughly examine the result. If crypt() failed instead, the programmer's mistake would be much more obvious.


Test script:
---------------
/* PHP 5.2 */
if (crypt('password', '$2') == crypt('password', '$2a$11$07fc1ae880d703a7a83424)
    echo "TRIPLE_DES selection";

/* PHP 5.4 */
crypt('password', '$2'); /* Outputs same as above. */

Expected result:
----------------
I expect crypt('password', '$2') to return a failure.

Actual result:
--------------
crypt('password', '$2') returns a valid hash.