php - Crypt generating *0 -

crypt is, sometimes, generating string *0 instead of real hash.

const salt_byte_size = 24; const hash_payload = 13; public static function createhash($password, $cost = self::hash_payload) {      $salt = '$2a$' . $cost . '$' . base64_encode(mcrypt_create_iv(self::salt_byte_size, mcrypt_dev_urandom));       $password = crypt($password, $salt);     return $password; } 

i found line base64_encode(mcrypt_create_iv(self::salt_byte_size, mcrypt_dev_urandom)); somewhere around stackoverflow, stating way generate random salt. been few weeks couldn't find answer again. wonder if random salt maybe causing crypt generate string *0.

the given password alphanumeric string, 8 chars long.

crypt returns *0 if given invalid salt - , that's case here. quoting the doc:

blowfish hashing salt follows: "$2a$", "$2x$" or "$2y$", 2 digit cost parameter, "$", , 22 characters alphabet "./0-9a-za-z"

most probably, you've assumed base64_encode() returns strings of same set of characters. it's not - there's + sign (the full alphabet [a-za-z0-9+/]).

an obvious workaround replacing + .:

$salt = '$2a$' . $cost . '$' .    str_replace('+', '.',      base64_encode(mcrypt_create_iv(self::salt_byte_size, mcrypt_dev_urandom)));