How to migrate from sha256 encryption to bcrypt for PHP?

Question

For Login :

$rows       = $sql->fetch(PDO::FETCH_ASSOC);
$us_id      = $rows['id'];
$us_pass    = $rows['password'];
$us_salt    = $rows['password_salt'];
$status     = $rows['attempt'];
$saltedPass = hash('sha256', "{$password}{$this->passwordSalt}{$us_salt}");

For Register :

$randomSalt = $this->rand_string(20);
$saltedPass = hash('sha256', "{$password}{$this->passwordSalt}{$randomSalt}");

How can this sha256 encryption method be converted to bcrypt?

You really shouldn't use your own salts on password hashes and you really should use PHP's built-in functions to handle password security. — Jay Blanchard
– Jay Blanchard, Commented Jun 19, 2015 at 14:13
Actually , I have used bcrypt in my mobile application. Hence I want to change my web application's encryption as I am sharing the database. How could that help me? — Abhay Naik
– Abhay Naik, Commented Jun 19, 2015 at 14:15

Grokify · Accepted Answer · 2015-06-19 14:37:23Z

4

Password Hashing Using bcrypt

If you are using PHP 5.5 or later, you can use the built-in password_hash() function with the $algo parameter set to PASSWORD_BCRYPT to create bcrypt hashes. You can use this as so:

$options = array('cost' => 11, 'salt' => 'my_salt');
$hash = password_hash("my_secret_password", PASSWORD_BCRYPT, $options);

Migration

It's not possible to do a bulk migration from sha256 to bcrypt because you need the original plaintext data (password) which isn't available.

Typically, sites do a staged conversion where you convert users as they perform successful logins. For example:

create a field in your database for password has type, sha256 or bcrypt
upon login, verify the password using the type in the database
if sha256 and successful, create a new bcrypt entry using the entered password, store that and update the password type to bcrypt. On the next login, bcrypt will now be used for verification.

edited Jun 19, 2015 at 14:37

answered Jun 19, 2015 at 14:17

Grokify

16.5k8 gold badges70 silver badges94 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

Abhay Naik Over a year ago

I just wanted to change those above lines . Those are the only two lines which are sha256 . So is there any way that I can change those lines?

Grokify Over a year ago

If you are on PHP 5.5 or later, you can use the password_hash() function with the PASSWORD_BCRYPT option. I've added this to the answer above. Are you on PHP 5.5 or later?

Abhay Naik Over a year ago

Yes, I am using PHP 5.5.

Scott Arciszewski Over a year ago

You should not be generating your own salt. Let password_hash() generate the salt for you. It uses a CSPRNG.

Collectives™ on Stack Overflow

How to migrate from sha256 encryption to bcrypt for PHP?

1 Answer 1

4 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

4 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related