4

I'm using PHPass to store users passwords in my application because it's more secure than md5 or sha1. I have a question about how I would use a salt with the passwords.

From what I gathered, I use it like this when you insert a user:

$pwdHasher = new PasswordHash(8, false);
$hash = $pwdHasher->HashPassword($input_password);

and then when you check the users details on login, you do:

$pwdHasher = new PasswordHash(8, FALSE);
if ($pwdHasher->CheckPassword($input_password, $hash_from_db)) {
    echo 'password correct';
} else {
    echo 'wrong credentials';
}

But I see nothing there that uses a salt. From what I've read, my user table should have an extra field for a salt that is used when hashing the password, but the CheckPassword method of PHPass doesn't take a salt?

Thanks.

James Dawson
  • 5,309
  • 20
  • 72
  • 126
  • possible duplicate of [Is the salt contained in a phpass hash or do you need to salt its input?](http://stackoverflow.com/questions/2596348/is-the-salt-contained-in-a-phpass-hash-or-do-you-need-to-salt-its-input) – Sebastian Paaske Tørholm Dec 29 '11 at 22:55
  • I would offcourse tell you to use my library instead. But that would just be wrong. PHPass might create the salt itself, and then store it inside the hash. Just from a quick look at the documentation. – Audun Larsen Dec 29 '11 at 22:59

1 Answers1

6

Phpass adds a salt when it hashes the password so there's no need to add a separate salt and store it in your database.

FajitaNachos
  • 1,000
  • 8
  • 21