How can I compare my PHPASS-hashed stored password to my incoming POST data?

Question

Here's a better example, just a simple checking..stored value in database has password: fafa (hashed with phpass in registration) and username: fafa; i am using the phpass password hashing framework

public function demoHash($data) //$data is the post data named password
{

 $hash =new PasswordHash(8, false);
 $query = ORM::factory('user');
 $result = $query
  ->select('username, password')
  ->where('username', 'fafa')
  ->find();
 $hashed = $hash->HashPassword($data);
 $check = $hash->CheckPassword($hashed, $result->password);
 echo $result->username . "<br/>";
 echo $result->password . "<br/>";
 return $check;
}

check is returning false

Answer 1

Your hashing algorithm should return the same hash when given the same password. Therefore, running HashPassword on the POSTed data should ALWAYS equal the hash saved in the database.

Hash the POSTed password with the same function and compare to the previously saved hash.

Answer 2

Right now your $hash variable is declared local to the register() function. You need to move it outside both functions and use global $hash inside each to scope it properly, or initialize it separately in both functions as a local variable.

Edit: Modifications to your updated code below.

public function demoHash($data) //$data is the post data named password
{

        $hash =new PasswordHash(8, false);
        $query = ORM::factory('user');
        $result = $query
                ->select('username, password')
                ->where('username', 'fafa')
                ->find();
        //$hashed = $hash->HashPassword($data);
        $check = $hash->CheckPassword($data, $result->password);
        echo $result->username . "<br/>";
        echo $result->password . "<br/>";
        return $check;
}

Don't pass a hashed input to the first argument of CheckPassword - it's designed to do the hashing on its own.

Answer 3

I'm not sure there is enough info here to determine the problem- lets see if we can clarify a few things- I'll add some values and you let me know if the flow is correct:

function register()
{
// register user
$hash = new PasswordHash(8, FALSE);// hash = abcd1234
$hashed = $hash->HashPassword($hash);// hashed = DF431268

//register logic here
}

function login()
{
// login user
$data = $_POST['password']; // data = abcd1234
$password = // query password here // password = DF431268
$check = $hash->CheckPassword($data, $password); // assuming this function hashes $data through the same $hash->HashPassword($hash) function previously and then returns true if they are the same, check should be true...
return $check // check is returning false!
}

can you post the CheckPassword method of your hash class?

Answer 4

Assuming that $result->password is already hashed, try this:

$check = $hash->CheckPassword($data, $result->password);

Or even this:

$check = $hash->HashPassword($data) === $result->password;

Answer 5

I got the same problem with CheckPassword() and the problem was actually with my database: the password field was not long enough for storing the entire hashed password.

Seeing the examples phpass comes with, I setted my field password to 60 characters length and now it works.