Password change with CakePHP and blowfish

Question

I am trying to set up a form that allows the user to change their password using CakePHP 2.3. The algorithm used is blowfish. I have three fields:

<?php echo $this->Form->input('old_password', array('type' => 'password', 'autocomplete' => 'off')); ?> <?php echo $this->Form->input('new_password', array('type' => 'password', 'autocomplete' => 'off')); ?> <?php echo $this->Form->input('new_password_confirm', array('type' => 'password', 'autocomplete' => 'off', 'label' => 'Confirm Password')); ?> 

Here is the code where I am trying to verify that they entered their old password correctly:

 $hash = Security::hash($this->request->data['User']['old_password'], 'blowfish'); $correct = $this->User->find('first', array( 'conditions' => array( 'User.id' => AuthComponent::user('id'), 'User.password' => $hash ), 'fields' => array('id') )); 

The problem is that even if I type the old password correctly, Cake never finds the user, because it does not seem to calculate the correct hash. Each time I submit a form with the same old password, Cake generates a different hash each time. This is probably due to the fact that I do not understand how the blowfish / bcrypt algorithm works, but I can not understand it.

What am I missing here?

Answer 1

Work with blowfish hashes is different from other hash types. In the hash API docs:

Hash comparison: just pass the original hashed password as salt.

This means that in your case, you first need to get the hashed password for a specific user, and then use it as a salt. Sort of

 $user = $this->User->find('first', array( 'conditions' => array( 'User.id' => AuthComponent::user('id') ), 'fields' => array('password') )); $storedHash = $user['User']['password']; $newHash = Security::hash($this->request->data['User']['old_password'], 'blowfish', $storedHash); $correct = $storedHash == $newHash; 

Answer 2

Easy to add to Models, for example, users.

Link source: https://bitbucket.org/snippets/eom/arzxR

 /** * Users Model */ class Users extends AppModel { ......... public function beforeSave($options = array()) { parent::beforeSave($options); // Save new password is exist..? if (isset($this->data[$this->alias]['password'])==true) { // Security bcrypt Blowfish App::uses('Security', 'Utility'); $hash = Security::hash($this->data[$this->alias]['password'], 'blowfish'); $this->data[$this->alias]['password'] = $hash; } return true; } public function password_check($user_id = null, $password_check = null) { // Get password old $hash_old = $this->field('password',array('id'=>trim($user_id))); // Security bcrypt Blowfish App::uses('Security', 'Utility'); $hash_new_check = Security::hash($password_check, 'blowfish', $hash_old); // Son iguales if($hash_new_check == $hash_old){ return true; } return false; } public function password_update($user_id = null, $password_new = null) { // Update new password if($this->save(array('id'=>$user_id, 'password'=>$password_new))){ return true; } return false; } ......... }