1: <?php
 2: 
 3: /**
 4:  * This file is part of the Nette Framework (https://nette.org)
 5:  * Copyright (c) 2004 David Grudl (http://davidgrudl.com)
 6:  */
 7: 
 8: namespace Nette\Security;
 9: 
10: use Nette;
11: 
12: 
13: /**
14:  * Passwords tools. Requires PHP >= 5.3.7.
15:  *
16:  * @author     David Grudl
17:  */
18: class Passwords
19: {
20:     const PASSWORD_MAX_LENGTH = 4096;
21:     const BCRYPT_COST = 10;
22: 
23: 
24:     /**
25:      * Computes salted password hash.
26:      * @param  string
27:      * @param  array with cost (4-31), salt (22 chars)
28:      * @return string  60 chars long
29:      */
30:     public static function hash($password, array $options = NULL)
31:     {
32:         $cost = isset($options['cost']) ? (int) $options['cost'] : self::BCRYPT_COST;
33:         $salt = isset($options['salt']) ? (string) $options['salt'] : Nette\Utils\Random::generate(22, '0-9A-Za-z./');
34: 
35:         if (PHP_VERSION_ID < 50307) {
36:             throw new Nette\NotSupportedException(__METHOD__ . ' requires PHP >= 5.3.7.');
37:         } elseif (($len = strlen($salt)) < 22) {
38:             throw new Nette\InvalidArgumentException("Salt must be 22 characters long, $len given.");
39:         } elseif ($cost < 4 || $cost > 31) {
40:             throw new Nette\InvalidArgumentException("Cost must be in range 4-31, $cost given.");
41:         }
42: 
43:         $hash = crypt($password, '$2y$' . ($cost < 10 ? 0 : '') . $cost . '$' . $salt);
44:         if (strlen($hash) < 60) {
45:             throw new Nette\InvalidStateException('Hash returned by crypt is invalid.');
46:         }
47:         return $hash;
48:     }
49: 
50: 
51:     /**
52:      * Verifies that a password matches a hash.
53:      * @return bool
54:      */
55:     public static function verify($password, $hash)
56:     {
57:         return preg_match('#^\$2y\$(?P<cost>\d\d)\$(?P<salt>.{22})#', $hash, $m)
58:             && $m['cost'] >= 4 && $m['cost'] <= 31
59:             && self::hash($password, $m) === $hash;
60:     }
61: 
62: 
63:     /**
64:      * Checks if the given hash matches the options.
65:      * @param  string
66:      * @param  array with cost (4-31)
67:      * @return bool
68:      */
69:     public static function needsRehash($hash, array $options = NULL)
70:     {
71:         $cost = isset($options['cost']) ? (int) $options['cost'] : self::BCRYPT_COST;
72:         return !preg_match('#^\$2y\$(?P<cost>\d\d)\$(?P<salt>.{22})#', $hash, $m)
73:             || $m['cost'] < $cost;
74:     }
75: 
76: }
77: