Re: crypt(), password_hash(), and password_verify()

Found another, the crypt() documentation needs "password_verify() is" added to it:
"password_hash() uses a strong hash, generates a strong salt, and applies proper rounds automatically. password_hash() is a simple crypt() wrapper and [password_verify() is] compatible with existing password hashes. Use of password_hash() is encouraged."


> On 02/19/2022 7:47 PM [email protected] wrote:
> 
>  
> Documentation for crypt() and password_verify() should be updated to say that password_verify() supports hashes created with crypt() because I was actually unaware of this. password_hash() documentation says:
> "password_hash() is compatible with crypt(). Therefore, password hashes created by crypt() can be used with password_hash()."
> 
> Which doesn't make sense since password_hash() only creates hashes. Also crypt() doesn't support Argon2 hashes. I believe this was suppose to be added to the password_verify() documentation but ended up on the wrong page.
> 
> 
> Also the crypt() documentation for CRYPT_EXT_DES says:
> The "salt" is a 9-character string consisting of an underscore followed by 4 bytes of iteration count and 4 bytes of salt. These are encoded as printable characters, 6 bits per character, least significant character first.
> 
> This should be:
> The "salt" is a 9-character string consisting of an underscore followed by 4 characters of iteration count and 4 characters of salt. Each of these 4 characters encode 24 bits, least significant character first.
> 
> See https://en.wikipedia.org/wiki/Crypt_(C)#BSDi_extended_DES-based_scheme: "BSDi extended the salt to 24 bits and made the number of rounds variable (up to 2^24-1)." Huh that section had the same error and it's been like that since August 2012. Anyway I fixed it there too.