Fatal error: Incorrect Usage Of Hashing Functions

Question

I have never seen this fatal error in PHP before... It started when I found a password hashing class on github:

 $Config = array(
        "Depreciated" => 1,
        "Notices" => 1,
        "Errors" => 1,
        "Warnings" => 1,
    );
    $Salt_Settings= 1;
    $Password_Hashing = new SlayerSolutions\Authentication($Salt_Settings,$Config);

$Password_Hashing ->SetSalt("f4dd32"); 
$Password_Hashing ->SetKey("Login"); 
$Password_Hashing ->SetPositioning(0); 

$Password_Entities = $Password_Hashing ->Password_Props($_POST['Password']);
$Result_Array = $Password_Hashing ->Hash_Password($Password_Entities );

This returns:

Fatal error: Incorrect Usage Of Hashing Functions. This must be executed in a step procedure.

I cannot view the actual code structure of the class as it seems to have been encoded with ioncube or something

Answer 1

Your error comes from not having done this:

 $Formatted_Password = $FrameWork->Format_Password($Password_Entities);

Which in effect sets $this->Props_Called = 1;. Absolutely pointless shit.

Why you should not be using this:

First OMGWTFBBQ moment:

else{
        $length = mt_rand(0,25);
        $characters = '0123456789abcdefghijklmnopqrstuvwxyz';
        $string = '';

        for ($p = 0; $p < $length; $p++) {
            $string .= $characters[mt_rand(5, strlen($characters) -1)];
        }
        $this->Salt = $string; // Set Salt Randomly Generated
 }

This bit of code generates a random salt. Instead of taking advantage of the full 255-byterange-or-more of ASCII, the guy is limiting himself to 36. Instead of having 255^N in entropy, you ahve 36^N. That's a BIG loss.

Second WTF moment:

if ($this->Positioning == 0){
            $Return_Array['SaltedPassword'] = $Password_Props['Password'].$Password_Props['Salt'];
        }
        if ($this->Positioning == 1){
            $Return_Array['SaltedPassword'] = $Password_Props['Salt'].$Password_Props['Password'];

The whole POINT of HMAC is to salt the key, NOT the message. There is a very important reason for this: it is due to the way HMAC hashing works. The salt "double dips" in the key, whereas it does not if it is in the value.

(For the record: HMAC-ALGO = ALGO( (key XOR pad1) CONCAT ALGO( (key XOR pad2) CONCAT value)) )

THIS is a major issue. You are, once again, losing quite a bit through doing this. Right now; if your salt is in the value, your algorithm is equivalent to ALGO(key ALGO(value)), which is no better than just ALGO(value . key).

Reference for this point is here: https://stackoverflow.com/a/7273257/2167834