I'm using PHPass to store users passwords in my application because it's more secure than md5 or sha1. I have a question about how I would use a salt with the passwords.
From what I gathered, I use it like this when you insert a user:
$pwdHasher = new PasswordHash(8, false);
$hash = $pwdHasher->HashPassword($input_password);
and then when you check the users details on login, you do:
$pwdHasher = new PasswordHash(8, FALSE);
if ($pwdHasher->CheckPassword($input_password, $hash_from_db)) {
echo 'password correct';
} else {
echo 'wrong credentials';
}
But I see nothing there that uses a salt. From what I've read, my user table should have an extra field for a salt that is used when hashing the password, but the CheckPassword
method of PHPass doesn't take a salt?
Thanks.
Phpass adds a salt when it hashes the password so there's no need to add a separate salt and store it in your database.