Support for scrypt hashing

Author: Crecket

README.md

@@ -16,13 +16,27 @@ Download the files and require them in your project.
 
 `require '/secure-functions/src/SecureFuncs.php';`
 
+## Scrypt and Encryption
+
+#### [domBlack/php-scrypt](https://github.com/DomBlack/php-scrypt)
+Install the php module if you want to use scrypt hashing
+
+
+#### [defuse/php-encryption](https://github.com/defuse/php-encryption)
+Is required if you want to make use of his encryption library. Will be automatically installed with composer
+ 
+
+
 ## Usage
 All functions are static public functions right now so you can simply call the functions like this:
 
 `SecureFuncs\SecureFuncs::password_hash('input');`
 
 ## Functions
 
+### compareStrings($string1, $string2)
+Compare strings while preventing timed attacks
+
 ### decrypt($input, $key)
 Returns the decryped output as a string using [defuse/php-encryption](https://github.com/defuse/php-encryption)'s library.
 
@@ -50,6 +64,12 @@ Return a random key using [defuse/php-encryption](https://github.com/defuse/php-
 ### randomString($length)
 Returns a random string for the given length
 
+### scryptcheck($password, $hash)
+Compare a password and hash using [DomBlack/php-scrypt](https://github.com/DomBlack/php-scrypt)
+
+### scrypthash($password, $salt, $cpu, $memory, $parallel)
+Hash a password using DomBlack's php scrypt library
+
 ### setFormToken($id)
 Set a unique token in the session and returns it, can be used to verify post/get requests
 

src/SecureFuncs.php

@@ -4,7 +4,10 @@
 class SecureFuncs
 {
 
-    public static $secret;
+    /**
+     * @var int The key length
+     */
+    private static $_keyLength = 32;
 
     /**
      * @param $input
@@ -67,7 +70,7 @@ public static function getFormToken($id, $token, $limit_time = 300)
                 // If time limit is set, check if isset
                 if ($limit_time !== false) {
                     // if time < limit time return true/false
-                    if (empty($_SESSION['formtoken_time'][$id]) || $_SESSION['formtoken_time'][$id] < time() - $limit_time){
+                    if (empty($_SESSION['formtoken_time'][$id]) || $_SESSION['formtoken_time'][$id] < time() - $limit_time) {
                         $valid = false;
                     }
                 }
@@ -213,4 +216,170 @@ public static function pseudoBytes($length = 1)
         }
     }
 
+    /**
+     * Scrypt functions
+     *
+     * Based on php-scrypt - https://github.com/DomBlack/php-scrypt
+     */
+
+    /**
+     * Generates a random salt
+     *
+     * @param int $length The length of the salt
+     *
+     * @return string The salt
+     */
+    public static function generateSalt($length = 8)
+    {
+        $buffer = '';
+        $buffer_valid = false;
+        if (function_exists('mcrypt_create_iv') && !defined('PHALANGER')) {
+            $buffer = mcrypt_create_iv($length, MCRYPT_DEV_URANDOM);
+            if ($buffer) {
+                $buffer_valid = true;
+            }
+        }
+        if (!$buffer_valid && function_exists('openssl_random_pseudo_bytes')) {
+            $cryptoStrong = false;
+            $buffer = openssl_random_pseudo_bytes($length, $cryptoStrong);
+            if ($buffer && $cryptoStrong) {
+                $buffer_valid = true;
+            }
+        }
+        if (!$buffer_valid && is_readable('/dev/urandom')) {
+            $f = fopen('/dev/urandom', 'r');
+            $read = static::strlen($buffer);
+            while ($read < $length) {
+                $buffer .= fread($f, $length - $read);
+                $read = static::strlen($buffer);
+            }
+            fclose($f);
+            if ($read >= $length) {
+                $buffer_valid = true;
+            }
+        }
+        if (!$buffer_valid || static::strlen($buffer) < $length) {
+            $bl = static::strlen($buffer);
+            for ($i = 0; $i < $length; $i++) {
+                if ($i < $bl) {
+                    $buffer[$i] = $buffer[$i] ^ chr(mt_rand(0, 255));
+                } else {
+                    $buffer .= chr(mt_rand(0, 255));
+                }
+            }
+        }
+        $salt = str_replace(array('+', '$'), array('.', ''), base64_encode($buffer));
+
+        return $salt;
+    }
+
+    /**
+     * Create a password hash
+     *
+     * @param string $password The clear text password
+     * @param string|bool $salt The salt to use, or null to generate a random one
+     * @param int $N The CPU difficultly (must be a power of 2, > 1)
+     * @param int $r The memory difficultly
+     * @param int $p The parallel difficultly
+     *
+     * @throws \Exception
+     *
+     * @return string The hashed password
+     */
+    public static function scrypthash($password, $salt = false, $N = 16384, $r = 8, $p = 1)
+    {
+        // Check if scrypt extension is available
+        if (!extension_loaded('scrypt')) {
+            throw new \Exception('Missing scrypt extension');
+        }
+
+        if ($N == 0 || ($N & ($N - 1)) != 0) {
+            throw new \InvalidArgumentException("N must be > 0 and a power of 2");
+        }
+
+        if ($N > PHP_INT_MAX / 128 / $r) {
+            throw new \InvalidArgumentException("Parameter N is too large");
+        }
+
+        if ($r > PHP_INT_MAX / 128 / $p) {
+            throw new \InvalidArgumentException("Parameter r is too large");
+        }
+
+        if ($salt === false) {
+            $salt = self::generateSalt();
+        } else {
+            // Remove dollar signs from the salt, as we use that as a separator.
+            $salt = str_replace(array('+', '$'), array('.', ''), base64_encode($salt));
+        }
+
+        $hash = scrypt($password, $salt, $N, $r, $p, self::$_keyLength);
+
+        return $N . '$' . $r . '$' . $p . '$' . $salt . '$' . $hash;
+    }
+
+    /**
+     * Check a clear text password against a hash
+     *
+     * @param string $password The clear text password
+     * @param string $hash The hashed password
+     *
+     * @throws \Exception
+     *
+     * @return boolean If the clear text matches
+     */
+    public static function scryptcheck($password, $hash)
+    {
+        // Check if scrypt extension is available
+        if (!extension_loaded('scrypt')) {
+            throw new \Exception('Missing scrypt extension');
+        }
+
+        // Is there actually a hash?
+        if (!$hash) {
+            return false;
+        }
+
+        list ($N, $r, $p, $salt, $hash) = explode('$', $hash);
+
+        // No empty fields?
+        if (empty($N) or empty($r) or empty($p) or empty($salt) or empty($hash)) {
+            return false;
+        }
+
+        // Are numeric values numeric?
+        if (!is_numeric($N) or !is_numeric($r) or !is_numeric($p)) {
+            return false;
+        }
+
+        $calculated = scrypt($password, $salt, $N, $r, $p, self::$_keyLength);
+
+        // Use compareStrings to avoid timeing attacks
+        return self::compareStrings($hash, $calculated);
+    }
+
+    /**
+     * Prevent timing attacks
+     *
+     * @param string $expected
+     * @param string $actual
+     *
+     * @return boolean If the two strings match.
+     */
+    public static function compareStrings($expected, $actual)
+    {
+        $expected = (string)$expected;
+        $actual = (string)$actual;
+        $lenExpected = static::strlen($expected);
+        $lenActual = static::strlen($actual);
+        $len = min($lenExpected, $lenActual);
+
+        $result = 0;
+        for ($i = 0; $i < $len; $i++) {
+            $result |= ord($expected[$i]) ^ ord($actual[$i]);
+        }
+        $result |= $lenExpected ^ $lenActual;
+
+        return ($result === 0);
+    }
+
 }