Question

When hashing two random strings, I get on average 2 collisions out of 100,000. Is this expected?

All of these strings produce the same hash (using any salt and any work factor):

base64_decode('/g=');
base64_decode('/gB/==');
base64_decode('/gBQyVY/0dzg');
base64_decode('/gBQyoK71jVY/JZP0dzg=');
base64_decode('/gBQyoK71jVY/J2ea4q9mAZP0dzg==');
base64_decode('/gBQyoK71jVY/J7QuBNJuFdxyf2eTBCs42chkx6ZvpJYszpUcJk8/HXa4q9mAZP0dzg=');

And these are just examples, try adding and removing characters from the center, you get many more matches. Here is the php code used to find them:

set_time_limit(60*10);
$salt = '$2a$04$usesomesillystringforsalt$';
for($i=0; $i < 100000; $i++){
    $one = openssl_random_pseudo_bytes(rand(1,111));
    $two = openssl_random_pseudo_bytes(rand(1,111));
    if(crypt($one, $salt)==crypt($two, $salt)){
        echo base64_encode($one).'|'.base64_encode($two)."\n";
    }
}
Was it helpful?

Solution

Nevermind, PHP doesn't play well with strings having a null byte.
The PHP crypt function is not binary safe.

Licensed under: CC-BY-SA with attribution
Not affiliated with StackOverflow
scroll top