Export databases: are the data modified at the bit level

-1

Thanks to my last question about hashed passwords:

Function password_verify : Error comparing passwords

I'm curious how a hasheado works in PHP.

Quoting the web:

  

The hashing function produces a single length result    Fixed , if for some reason or another, a single bit of information is    modified , this will necessarily produce a different hash   original.

Then the following happens:

  

If I apply the password_hash 100 times to a specific value, it returns   100 different results, despite this having not been modified

Or if it is.? .

  

However, the function password_verify has the ability to compare if the value entered in a variable is equal to the hash that is possessed (saved or not in a database).

This is where I take reference to my question, if I have already hashed a data (contained in a database A) and returns true when compared with its hash

Why when exporting it to another database (B) is it no longer valid?

Are the bits that make up this data moded? .

  

I also note the fact of hash collision , when two data of   Different types have the same hash.

If two data can generate the same hash and collide (because they will be the same in a hash string), because when exporting my data they are no longer valid, thus giving rise to nothing else that I read:

  

To know if the value hasheado is equal to another, the algorithm hashea both values and check if the generated chains are equal.

Check the liberia passwordLib.php and it contains the following:

if (!function_exists('password_verify')){
    function password_verify($password, $hash){
        return (crypt($password, $hash) === $hash);
    }
}

I see that you have a crypt of the password and the hash that you have, therefore if you apply the process of encrypting the password again or failing that value.

I conclude with my question:

Are these data modified (internally) when going from one database to another?

    
asked by Victor Alvarado 27.04.2017 в 16:02
source

1 answer

1
  

If I apply the password_hash 100 times to a specific value, it returns 100 different results, although this has not been modified

A hashing function is deterministic, it always returns the same if the entry is the same.

What is there is that password_hash of PHP uses a salt , that is to say that the input adds a string ( salt ) that by default is random.

However, the salt is kept visible (not encrypted / hashed) as part of the result, so that password_verify can know it.

  

Why, when exporting it to another database (B) is it no longer valid?

It is still valid, and I do not understand why you say it. Likewise, you are mixing pears with oranges, password_hash and password_verify are PHP functions that handle strings. What you do with those strings (save them in databases or whatever you want) is up to you.

What collisions have nothing to do.

You should explain in detail what your problem is.

    
answered by 28.04.2017 / 15:11
source