How to generate a password in PHP, as did the Devise Gem in Ruby on Rails

Question

I am upgrading a site from Ruby on Rails to PHP. I need to generate the passwords that are generated by the Devise Gem in Ruby on Rails. I should know what a password hashing method is for creating the same method with PHP. but it's not so easy to find codes inside Ruby on Rails as a beginner. If someone knows where I should check to find him, please help me.

These two are all I found:

1) The configuration of encryptor is disabled in devise.rb like below: # config.encryptor = :sha1 2) I read the comments very carefully then I found that they using sha512 and bcrypt as default encryptor. # (default), :sha512 and :bcrypt. Devise also supports encryptors from others 

I tried to make the same encrypted password differently with PHP:

 1) sha1('--'.$password_salt.'--'.$encrypted_password); 2) sha1($password_salt.'-----'.$encrypted_password); 3) sha1('--'.$password_salt.'--'.$encrypted_password.'--'); 4) sha1($password_salt.$encrypted_password); 5) sha1($encrypted_password.$password_salt); 6) substr(hash('sha512', $password_salt.$encrypted_password, false), 20); 7) substr(hash('sha512', $encrypted_password.$password_salt, false), 0, 40); 8) hash('sha512', $encrypted_password.$password_salt, false); 9) hash('sha512', $password_salt.$encrypted_password, false); 10) substr(hash('sha512', '--'.$password_salt.'--'.$encrypted_password.'--', false), 0, 40); 

I could not get the same result from any of the above. Is there anyone who could tell me the Devise Gem encryption method?

HELP ME !!!

ps. I'm not good at English. Even if my English is incorrect, please do not be angry.

---

I answer:

• Cipher Sha1

  I looked only "devise.rb" in the folder "\ config \ initializers" The code was entered as "# config.encryptor =: sha1" But inside the Ruby lib folder there is another "devise.rb", "\ Ruby191 \ Lib \ ruby \ gems \ 1.9.1 \ gems \ invent-1.0.8 \ Lib \ devise.rb "There is another configuration:" @@ encryptor =: sha1 "

• The encryption method using Sha1. When you go to the file below, you will see codes for the algorithm: \ Ruby191 \ Lib \ Ruby \ Gems \ 1.9.1 \ Gems \ Invent-1.0.8 \ Lib \ Develop \ Encryptors \ sha1.rb

  requires "digest / sha1"

  module Encryption of modules # = Sha1 # Uses the Sha1 hash algorithm to encrypt passwords. class Sha1 <Base

    # Gererates a default password digest based on stretches, salt, pepper and the # incoming password. def self.digest(password, stretches, salt, pepper) digest = pepper stretches.times { digest = self.secure_digest(salt, digest, password, pepper) } digest end private # Generate a SHA1 digest joining args. Generated token is something like # --arg1--arg2--arg3--argN-- def self.secure_digest(*tokens) ::Digest::SHA1.hexdigest('--' << tokens.flatten.join('--') << '--') end end end 

  end

So I translated into PHP

 function encrypt_password($salt, $password) { $pepper = ''; $digest = $pepper; $stretches = 10; for ($i=0; $i<$stretches; $i++) { $join = '--'.$salt.'--'.$digest.'--'.$password.'--'.$pepper.'--'; $digest = Sha1($join); } $result = substr($digest, 0, 40); return $result; } 

It works very well :-)

Answer 1

The development code looks like this:

  def self.digest(password, stretches, salt, pepper) ::BCrypt::Engine.hash_secret("#{password}#{pepper}",salt, stretches) end 

You can see how to make bcrypt in PHP on How do you use bcrypt to hash passwords in PHP?

By default, Devise uses 10 stretch marks.

The salt looks like the first 29 characters of an encrypted password. You can do (in rails) User.first.authenticable_salt

Pepper must be specified in config/initializers/devise.rb , but it can use the secret token of your application.

See https://github.com/plataformatec/devise/blob/master/lib/devise/models/encryptable.rb

Answer 2

According to Devem Gem sources, this method is a bit more complicated. part of SHA512 will look something like this:

 function sha512_digest($password, $stretches, $salt, $pepper) { $digest = $pepper; for ($i = 0; $i < $stretches; $i++) { $digest = hash('sha512', '--' . $salt . '--' . $digest . '--' . $password . '--' . $pepper . '--'); } } 

The BCrypt part is unclear to me, the only thing that I have found out so far is that it is Blowfish encryption.