80 lines
2.5 KiB
PHP
80 lines
2.5 KiB
PHP
<?php
|
|
|
|
namespace WhiteHat101\Crypt;
|
|
|
|
class APR1_MD5
|
|
{
|
|
public const BASE64_ALPHABET = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/';
|
|
public const APRMD5_ALPHABET = './0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz';
|
|
|
|
// Source/References for core algorithm:
|
|
// http://www.cryptologie.net/article/126/bruteforce-apr1-hashes/
|
|
// http://svn.apache.org/viewvc/apr/apr-util/branches/1.3.x/crypto/apr_md5.c?view=co
|
|
// http://www.php.net/manual/en/function.crypt.php#73619
|
|
// http://httpd.apache.org/docs/2.2/misc/password_encryptions.html
|
|
// Wikipedia
|
|
|
|
public static function hash($mdp, $salt = null)
|
|
{
|
|
if (is_null($salt)) {
|
|
$salt = self::salt();
|
|
}
|
|
$salt = substr($salt, 0, 8);
|
|
$max = strlen($mdp);
|
|
$context = $mdp.'$apr1$'.$salt;
|
|
$binary = pack('H32', md5($mdp.$salt.$mdp));
|
|
for ($i = $max; $i > 0; $i -= 16) {
|
|
$context .= substr($binary, 0, min(16, $i));
|
|
}
|
|
for ($i = $max; $i > 0; $i >>= 1) {
|
|
$context .= ($i & 1) ? chr(0) : $mdp[0];
|
|
}
|
|
$binary = pack('H32', md5($context));
|
|
for ($i = 0; $i < 1000; ++$i) {
|
|
$new = ($i & 1) ? $mdp : $binary;
|
|
if ($i % 3) {
|
|
$new .= $salt;
|
|
}
|
|
if ($i % 7) {
|
|
$new .= $mdp;
|
|
}
|
|
$new .= ($i & 1) ? $binary : $mdp;
|
|
$binary = pack('H32', md5($new));
|
|
}
|
|
$hash = '';
|
|
for ($i = 0; $i < 5; ++$i) {
|
|
$k = $i + 6;
|
|
$j = $i + 12;
|
|
if (16 == $j) {
|
|
$j = 5;
|
|
}
|
|
$hash = $binary[$i].$binary[$k].$binary[$j].$hash;
|
|
}
|
|
$hash = chr(0).chr(0).$binary[11].$hash;
|
|
$hash = strtr(
|
|
strrev(substr(base64_encode($hash), 2)),
|
|
self::BASE64_ALPHABET,
|
|
self::APRMD5_ALPHABET
|
|
);
|
|
return '$apr1$'.$salt.'$'.$hash;
|
|
}
|
|
|
|
// 8 character salts are the best. Don't encourage anything but the best.
|
|
public static function salt()
|
|
{
|
|
$alphabet = self::APRMD5_ALPHABET;
|
|
$salt = '';
|
|
for ($i = 0; $i < 8; ++$i) {
|
|
$offset = hexdec(bin2hex(openssl_random_pseudo_bytes(1))) % 64;
|
|
$salt .= $alphabet[$offset];
|
|
}
|
|
return $salt;
|
|
}
|
|
|
|
public static function check($plain, $hash)
|
|
{
|
|
$parts = explode('$', $hash);
|
|
return self::hash($plain, $parts[2]) === $hash;
|
|
}
|
|
}
|