[wp-trac] [WordPress Trac] #21022: Use bcrypt for password hashing; updating old hashes

[WordPress Trac]

#21022: Use bcrypt for password hashing; updating old hashes
-------------------------------------------------+-------------------------
 Reporter:  th23                                 |       Owner:
                                                 |  johnbillion
     Type:  enhancement                          |      Status:  reopened
 Priority:  normal                               |   Milestone:  6.8
Component:  Security                             |     Version:  3.4
 Severity:  normal                               |  Resolution:
 Keywords:  has-patch needs-testing has-unit-    |     Focuses:
  tests has-dev-note                             |
-------------------------------------------------+-------------------------

Comment (by paragoninitiativeenterprises):

 > Change wp_fast_hash() to be a shorter key length (48char max to work
 with a time() prefix and 60chars) - base64 gets the hash part down to
 44char compared to 64char with bin2hex, but there's still the '$generic$'
 prefix.

 You can also change the output length:
 https://www.php.net/manual/en/function.sodium-crypto-generichash.php

 {{{#!php
 function wp_fast_hash(
         #[\SensitiveParameter]
         string $message
 ): string {
         $hashed = sodium_crypto_generichash( $message, '', 24 );
         return '$generic$' . sodium_bin2base64( $hashed,
 SODIUM_BASE64_VARIANT_URLSAFE_NO_PADDING );
 }
 }}}

 The above snippet uses a 192-bit hash output (the BLAKE2b default is
 256-bit). You're looking at a 50% chance of colliding this if you
 calculate roughly 2^96^ different fast hashes. I definitely wouldn't
 recommend going any shorter than 24 for the output length.

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/21022#comment:224>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform