README

MyBlowfish 是一个简单的 PHP 类，用于使用 Blowfish 算法进行密码散列和检查。它在 PHP 5.3 到 8.0 的版本上都经过全面测试。

它最初是为 ATK14 框架 开发的。但它可以适应任何其他应用程序。

基本用法

$password = "honeyBump";
MyBlowfish::IsHash($password); // false

$hash = MyBlowfish::Filter($password);
MyBlowfish::IsHash($hash); // true

// A different salt is used automatically in another call of Filter().
// So the new hash from the same password differs from the old one.
$hash2 = MyBlowfish::Filter($password); // $hash2 !== $hash

// Filter() doesn't make hash from a hash!
$hash3 = MyBlowfish::Filter($hash); // $hash3 === $hash

// There is also method GetHash() which makes hash in every case.
$hash4 = MyBlowfish::GetHash($hash); // $hash4 !== $hash

MyBlowfish::CheckPassword($password,$hash); // true
MyBlowfish::CheckPassword("badTry",$hash); // false
MyBlowfish::CheckPassword($hash,$hash); // false

MyBlowfish::CheckPassword($password,$hash2); // true

MyBlowfish::CheckPassword($password,$hash4); // false
MyBlowfish::CheckPassword($hash,$hash4); // true

MyBlowfish::CheckPassword($password,$password); // false; 2nd params is not a blowfish hash

Blowfish 轮数

Blowfish 散列计算的复杂度会受到 Blowfish 轮数的影响。Blowfish 轮数越高，密码破解过程可能消耗的时间越长。在 MyBlowfish 中，默认值设置为 12。

可以通过常量 MY_BLOWFISH_ROUNDS 设置 Blowfish 轮数。

// min .. 4
// max .. 31
// optimal .. 10, 11, 12
// default .. 12
define('MY_BLOWFISH_ROUNDS',12);

请注意，高值的 Blowfish 轮数可能会导致散列计算时间过长。

Blowfish 散列前缀

Blowfish 散列以 , 或 . 开头。MyBlowfish 可以处理所有这些。

默认前缀可以通过常量 MY_BLOWFISH_PREFIX 设置。默认情况下为 .

// default .. '$2a$'
define('MY_BLOWFISH_PREFIX','$2b$');

ATK14 项目中的常用集成

考虑一个包含“login”和“password”等文本字段的“users”表。我们不希望在“password”字段中存储可读的密码，只想在其中存储 Blowfish 散列。这可以在 User 模型类中实现。

<?php
// file: app/models/user.php
class User extends ApplicationModel {

  /**
   * During a new user creation it provides transparent password hashing when it's needed
   *
   *    $user = User::CreateNewRecord([
   *      "login" => "rambo",
   *      "password" => "secret123"
   *    ]);
   */
  static function CreateNewRecord($values,$options = []){
    if(isset($values["password"])){
      $values["password"] = MyBlowfish::Filter($values["password"]);
    }
    return parent::CreateNewRecord($values,$options);
  }

  /**
   * It provides transparent password hashing during setting new values
   *
   *    $rambo->setValues(["password" => "newModelArmy"]);
   */
  function setValues($values,$options = []){
    if(isset($values["password"])){
      $values["password"] = MyBlowfish::Filter($values["password"]);
    }
    return parent::setValues($values,$options);
  }
  
  /**
   * Returns user when a correct combination of login and password is given.
   *
   *    $user = User::Login("rambo","secret123");
   */
  static function Login($login,$password){
    $user = User::FindByLogin($login);
    if(!$user){ return; }
    if(MyBlowfish::CheckPassword($password,$user->getPassword())){
      return $user;
    }
  }
}

让我们在 ATK14 控制台中测试一下

php > $user = User::CreateNewRecord(['login' => 'rambo', 'password' => 'secret123']);
php > echo $user->getPassword();
$2a$12$w984Nf6g67ZZKqvXgQWqwuj4mOn9Ptmw.dMNs/A7G9Cj/mt/w5buy
php > $user->setValue('password','newModelArmy');
php > echo $user->getPassword();
$2a$12$2ljCknUGAtf5lSAo0txoFO9qqGH2dxLDr31Ii4VSHca0Zb8cHZZgu
php > $user->setValue('password','$2a$12$2ljCknUGAtf5lSAo0txoFO9qqGH2dxLDr31Ii4VSHca0Zb8cHZZgu');
php > echo $user->getPassword();
$2a$12$2ljCknUGAtf5lSAo0txoFO9qqGH2dxLDr31Ii4VSHca0Zb8cHZZgu

安装

安装 MyBlowfish 的最佳方式是使用 Composer

composer require yarri/my-blowfish

许可

MyBlowfish 是免费软件，根据 MIT 许可证分发