Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
[Security] Added Pbkdf2PasswordEncoder
[Security] changed default iterations of Pbkdf2PasswordEncoder to 1000 instead of 5000 [Security] Improved description of PBKDF2 encoder [SecurityBundle] added PBKDF2 PasswordEncoder updated CHANGELOG.md [Security] Use the build-in hash_pbkdf2() when available [SecurityBundle] added information about hash_algorithm for configuration [Security] always check algorithm and fixed CS
- Loading branch information
Showing
11 changed files
with
189 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,6 +1,11 @@ | ||
CHANGELOG | ||
========= | ||
|
||
2.2.0 | ||
----- | ||
|
||
* Added PBKDF2 Password encoder | ||
|
||
2.1.0 | ||
----- | ||
|
||
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,6 +1,11 @@ | ||
CHANGELOG | ||
========= | ||
|
||
2.2.0 | ||
----- | ||
|
||
* Added PBKDF2 Password encoder | ||
|
||
2.1.0 | ||
----- | ||
|
||
|
97 changes: 97 additions & 0 deletions
97
src/Symfony/Component/Security/Core/Encoder/Pbkdf2PasswordEncoder.php
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,97 @@ | ||
<?php | ||
|
||
/* | ||
* This file is part of the Symfony package. | ||
* | ||
* (c) Fabien Potencier <fabien@symfony.com> | ||
* | ||
* For the full copyright and license information, please view the LICENSE | ||
* file that was distributed with this source code. | ||
*/ | ||
|
||
namespace Symfony\Component\Security\Core\Encoder; | ||
|
||
/** | ||
* Pbkdf2PasswordEncoder uses the PBKDF2 (Password-Based Key Derivation Function 2). | ||
* | ||
* Providing a high level of Cryptographic security, | ||
* PBKDF2 is recommended by the National Institute of Standards and Technology (NIST). | ||
* | ||
* But also warrants a warning, using PBKDF2 (with a high number of iterations) slows down the process. | ||
* PBKDF2 should be used with caution and care. | ||
* | ||
* @author Sebastiaan Stok <s.stok@rollerscapes.net> | ||
* @author Andrew Johnson | ||
* @author Fabien Potencier <fabien@symfony.com> | ||
*/ | ||
class Pbkdf2PasswordEncoder extends BasePasswordEncoder | ||
{ | ||
private $algorithm; | ||
private $encodeHashAsBase64; | ||
private $iterations; | ||
private $length; | ||
|
||
/** | ||
* Constructor. | ||
* | ||
* @param string $algorithm The digest algorithm to use | ||
* @param Boolean $encodeHashAsBase64 Whether to base64 encode the password hash | ||
* @param integer $iterations The number of iterations to use to stretch the password hash | ||
* @param integer $length Length of derived key to create | ||
*/ | ||
public function __construct($algorithm = 'sha512', $encodeHashAsBase64 = true, $iterations = 1000, $length = 40) | ||
{ | ||
$this->algorithm = $algorithm; | ||
$this->encodeHashAsBase64 = $encodeHashAsBase64; | ||
$this->iterations = $iterations; | ||
$this->length = $length; | ||
} | ||
|
||
/** | ||
* {@inheritdoc} | ||
* | ||
* @throws \LogicException when the algorithm is not supported | ||
*/ | ||
public function encodePassword($raw, $salt) | ||
{ | ||
if (!in_array($this->algorithm, hash_algos(), true)) { | ||
throw new \LogicException(sprintf('The algorithm "%s" is not supported.', $this->algorithm)); | ||
} | ||
|
||
if (function_exists('hash_pbkdf2')) { | ||
$digest = hash_pbkdf2($this->algorithm, $raw, $salt, $this->iterations, $this->length, true); | ||
} else { | ||
$digest = $this->hashPbkdf2($this->algorithm, $raw, $salt, $this->iterations, $this->length); | ||
} | ||
|
||
return $this->encodeHashAsBase64 ? base64_encode($digest) : bin2hex($digest); | ||
} | ||
|
||
/** | ||
* {@inheritdoc} | ||
*/ | ||
public function isPasswordValid($encoded, $raw, $salt) | ||
{ | ||
return $this->comparePasswords($encoded, $this->encodePassword($raw, $salt)); | ||
} | ||
|
||
private function hashPbkdf2($algorithm, $password, $salt, $iterations, $length = 0) | ||
{ | ||
// Number of blocks needed to create the derived key | ||
$blocks = ceil($length / strlen(hash($algorithm, null, true))); | ||
$digest = ''; | ||
|
||
for ($i = 1; $i <= $blocks; $i++) { | ||
$ib = $block = hash_hmac($algorithm, $salt . pack('N', $i), $password, true); | ||
|
||
// Iterations | ||
for ($j = 1; $j < $iterations; $j++) { | ||
$ib ^= ($block = hash_hmac($algorithm, $block, $password, true)); | ||
} | ||
|
||
$digest .= $ib; | ||
} | ||
|
||
return substr($digest, 0, $this->length); | ||
} | ||
} |
45 changes: 45 additions & 0 deletions
45
src/Symfony/Component/Security/Tests/Core/Encoder/Pbkdf2PasswordEncoderTest.php
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,45 @@ | ||
<?php | ||
|
||
/* | ||
* This file is part of the Symfony package. | ||
* | ||
* (c) Fabien Potencier <fabien@symfony.com> | ||
* | ||
* For the full copyright and license information, please view the LICENSE | ||
* file that was distributed with this source code. | ||
*/ | ||
|
||
namespace Symfony\Component\Security\Tests\Core\Encoder; | ||
|
||
use Symfony\Component\Security\Core\Encoder\Pbkdf2PasswordEncoder; | ||
|
||
class Pbkdf2PasswordEncoderTest extends \PHPUnit_Framework_TestCase | ||
{ | ||
public function testIsPasswordValid() | ||
{ | ||
$encoder = new Pbkdf2PasswordEncoder('sha256', false, 1, 40); | ||
|
||
$this->assertTrue($encoder->isPasswordValid('c1232f10f62715fda06ae7c0a2037ca19b33cf103b727ba56d870c11f290a2ab106974c75607c8a3', 'password', '')); | ||
} | ||
|
||
public function testEncodePassword() | ||
{ | ||
$encoder = new Pbkdf2PasswordEncoder('sha256', false, 1, 40); | ||
$this->assertSame('c1232f10f62715fda06ae7c0a2037ca19b33cf103b727ba56d870c11f290a2ab106974c75607c8a3', $encoder->encodePassword('password', '')); | ||
|
||
$encoder = new Pbkdf2PasswordEncoder('sha256', true, 1, 40); | ||
$this->assertSame('wSMvEPYnFf2gaufAogN8oZszzxA7cnulbYcMEfKQoqsQaXTHVgfIow==', $encoder->encodePassword('password', '')); | ||
|
||
$encoder = new Pbkdf2PasswordEncoder('sha256', false, 2, 40); | ||
$this->assertSame('8bc2f9167a81cdcfad1235cd9047f1136271c1f978fcfcb35e22dbeafa4634f6fd2214218ed63ebb', $encoder->encodePassword('password', '')); | ||
} | ||
|
||
/** | ||
* @expectedException LogicException | ||
*/ | ||
public function testEncodePasswordAlgorithmDoesNotExist() | ||
{ | ||
$encoder = new Pbkdf2PasswordEncoder('foobar'); | ||
$encoder->encodePassword('password', ''); | ||
} | ||
} |