使用没有crypt的Blowfish密码（）

Question

I'm actually, for testing and challenging purposes, trying to write a little password encryption system.

I've read about blowfish algorithm and I'm pretty interested in it, After reading the wikipedia page about it, I think the algorithm ould be the one I look for. But php's crypt() function do all the "dirty job" for you. From what I read in wikipedia, Blowfish is a symetric key cypher, meaning you can encrypt it and decrypt it with the same key (correct me if I'm wrong), So I'm looking for a way, in php, that allows you to use blowfish as his most primitive form : something like :

blowfis($data, $key, $rounds);

I'm pretty sure library like that exists but after some googling I didn't found anyone. So is such a lib exist? Or have I to write this function myself, wich is, I'm sure, really complex?

So my question is: Is it possible to use blowfish without crypt()? If it is, How? With a specific library? Or with native Php functions?

Answer 1

If your PHP version is >= 5.5 consider using password_hash and password_verify methods to encrypt and validate passwords. Also password_hash is compatible with crypt().

Try this:

$options = array(
    'salt' => 'Your very secret static salt here',
    'cost' => 12,
    );
$pass = password_hash("passwordProvided", PASSWORD_BCRYPT, $options);

At this point, $pass variable holds hashed version of passwordProvided and seems like something like that:

$2y$10$WW91ciB2ZXJ5IHNlY3Jld.w58GyS1ueaPDQ.93.N2PWoiRvJ12GiK

To verify password;

$hashed = '$2y$10$WW91ciB2ZXJ5IHNlY3Jld.w58GyS1ueaPDQ.93.N2PWoiRvJ12GiK';

if(password_verify('passwordProvided', $hashed)) {
    // Password is valid.
}

Note: Increasing the cost parameter by one, doubles the needed time to calculate the hash value.