From 0de04210abdd8df8a4b76557ba474f7681acff2b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C5=A0pa=C4=8Dek?= Date: Fri, 16 Feb 2024 14:56:28 +0100 Subject: [PATCH] Update README.md --- Passwords/php-hashes/README.md | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/Passwords/php-hashes/README.md b/Passwords/php-hashes/README.md index 236c2425..f48b0f43 100644 --- a/Passwords/php-hashes/README.md +++ b/Passwords/php-hashes/README.md @@ -1,6 +1,6 @@ # PHP magic hashes -PHP has some unique features which makes hash collisions more easier when using the `==` to compare. +PHP has some unique features which makes hash "collisions" more easier when using the `==` to compare. The raw text are taken directly from [spaze/hashes](https://github.com/spaze/hashes/) @@ -10,9 +10,9 @@ The raw text are taken directly from [spaze/hashes](https://github.com/spaze/has Any strings that starts with any numbers of `0`, followed by `e` then ends with only numbers will be treated as zero. An example of such strings are `0e123456` and `00e123456`. [Example code](https://3v4l.org/n8iOp) -This behavior can be extended to numbers, like `'0' == '000`. [Example code](https://3v4l.org/K9QRb) +This behavior can be extended to numbers, like `'0' == '000'`. [Example code](https://3v4l.org/K9QRb) -With loose comparison, these two example strings will equate to each other as both of them are treated as a zero in the backend. +With loose comparison `==`, these two example strings will equate to each other as both of them are treated as a zero in the backend. Sometimes, hashes of specific strings will result in those special strings as an result. Those hashes are called `magic hashes` @@ -40,8 +40,10 @@ Descrypt have similar behavior to bcrypt, but passwords are instead truncated to +These are a different kind of magic hashes, they don't need the loose comparison operator `==` and work even with strict comparison `===`. + If you use a password longer than 64 bytes and hash it with PBKDF2-HMAC-SHA1, it is first pre-hashed with SHA1. For example, `PBKDF2-HMAC-SHA1(password1) === PBKDF2-HMAC-SHA1(password2)` as `sha1(password1) === bin2hex(password2)`. -This behavior can also be seen in `PBKDF2-HMAC-SHA224` and `PBKDF2-HMAC-SHA256`. \ No newline at end of file +This behavior can also be seen in `PBKDF2-HMAC-SHA224` and `PBKDF2-HMAC-SHA256`.