使用salt验证用户登录

Question

I'm using salt to encrypt my users' passwords. I'm using PHP, and here's a quick sample of what happens during a users registers.

Here it is:

PHP code:

    // Gives me my random key. My salt generator.
    $salt = uniqid(mt_rand());

    // My password via what users inputs.
    $userpwd;

    // Then the encryption. I use a HMAC hash.
    $encrypted = hmac_hash("sha256", $userpwd, $salt);
?>

Now that all works for me in my script. But my question is, how do I authenticate a user logging in? The new encrypted password is random, so I can't compare the password from the login form to the saved encrypted password in the database.

I've searched and can't find a solution. Maybe I haven't searched hard enough, but is there a way to decrypt the password? What can I do to authenticate the user with my script?

Answer 1

You hash the user's inputted password the same way, then compare if the hash is the same as the one you stored.

if (hmac_hash("sha256", $_POST['password'], $saltFromDatabase) === $hashFromDatabase)
    $login = true;

You also have to store the salt since it's different for each user. I would also recommend using a second salt that is constant across the application (stored on a hard config file, so that even if the database is compromised, the passwords are still safe).

Note: Hashing is not the same as encryption; It is an irreversible process.