havash.php

<?php

/*
 * havash version 0.2.0
 *
 * The MIT License (MIT)
 * Copyright (c) 2014-2015 Abderraouf Adjal
 * 
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the “Software”), to deal
 * in the Software without restriction, including without limitation the rights
 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 * copies of the Software, and to permit persons to whom the Software is
 * furnished to do so, subject to the following conditions:
 * 
 * The above copyright notice and this permission notice shall be included in
 * all copies or substantial portions of the Software.
 * 
 * THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 * THE SOFTWARE.
 *
 */


/**
 * Return Values:
 *   On success: $bytes
 *   On failure: (-1) or (-2)
 */

function mk_rand_bytes($count)
{
	if (function_exists('mcrypt_create_iv')) {
		$bytes = mcrypt_create_iv($count, MCRYPT_DEV_URANDOM);
	}
	else if (function_exists('openssl_random_pseudo_bytes')) {
		$bytes = openssl_random_pseudo_bytes($count);
	}
	else if (is_readable('/dev/urandom') && ($urandom_fh = fopen('/dev/urandom', 'rb'))) {
		$bytes = fread($urandom_fh, $count);
		fclose($urandom_fh);
	}
	else {
		echo __FUNCTION__.': Fail to make random bytes.'.PHP_EOL;
		return -1;
	}
	
	if (strlen(bin2hex($bytes))/2 === $count) {
		return $bytes;
	}
	else {
		echo __FUNCTION__.': Generated bytes count is not the requested.'.PHP_EOL;
		return -2;
	}
}


/**
 * Return Values:
 *   On success: array(Hash in Hex, Salt)
 *   On failure:
 *     (-1): Invalid iterations value ($iterations < 0)
 *     (-2): Fail to get salt.
 *     
 */
 
function havash_hash($password, $iterations = 5000, $hash_func = 'sha256')
{
	$salt_len = 16; /* 128bit */
	
	if ($iterations < 0) {
		echo __FUNCTION__.': Invalid iterations value ($iterations < 0)'.PHP_EOL;
		return -1;
	}
	
	$salt = mk_rand_bytes($salt_len); /* You can use any CSPRNG (cryptographically secure pseudo-random number generator) */
	if ($salt < 0) {
		echo __FUNCTION__.': Fail to make random bytes for salt.'.PHP_EOL;
		return -2;
	}
	
	$h = hash_hmac($hash_func, $salt, $password, true);
	
	for ($i = 0; $i < $iterations; $i++) {
		$h = hash_hmac($hash_func, $h, $password, true);
	}
	
	return array(bin2hex($h), bin2hex($salt));
}


/**
 * Return Values:
 *   On success:
 *     true : Hashs are the same
 *     false: Hashs are NOT the same
 *   On failure:
 *     (-2): Invalid iterations value ($iterations < 0)
 */

function havash_check($password, $password_hash, $salt_hex, $iterations = 5000, $hash_func = 'sha256')
{
	if ($iterations < 0) {
		echo __FUNCTION__.': Invalid iterations value ($iterations < 0)'.PHP_EOL;
		return -2;
	}
	
	$salt = hex2bin($salt_hex);
	
	$h = hash_hmac($hash_func, $salt, $password, true);
	
	for ($i = 0; $i < $iterations; $i++) {
		$h = hash_hmac($hash_func, $h, $password, true);
	}
	
	$h = bin2hex($h);
	
	if (strlen($password_hash) !== strlen($h)) {
		return false;
	}
	
	/* hash_equals(): timing attack safe string comparison */
	return (function_exists('hash_equals') ? hash_equals($password_hash, $h) : $password_hash === $h);
}


?>