Format of the bcrypt password hash in ownCloud 10.0.9

cornelinux · August 10, 2018, 5:52pm

Hi,

I am looking at the default password hashes in the oc_users table in ownCLoud 10.0.9 and it looks like bcrypt hashing is used.

But I realize the hash is prefixed with a “1|”.
Why is that?

Can there be any other prefixes? I have an external application, that checks the ownCloud passwords, so I would like to know if there is a nother format.

Thanks a lot
Cornelius

jvillafanez · August 16, 2018, 6:53am

github.com

owncloud/core/blob/6b36c56180eee3ce796b1a69709431f1d38da627/lib/private/Security/Hasher.php#L79




	/**
	 * Hashes a message using PHP's `password_hash` functionality.
	 * Please note that the size of the returned string is not guaranteed
	 * and can be up to 255 characters.
	 *
	 * @param string $message Message to generate hash from
	 * @return string Hash of the message with appended version parameter
	 */
	public function hash($message) {
		return $this->currentVersion . '|' . \password_hash($message, PASSWORD_DEFAULT, $this->options);
	}


	/**
	 * Get the version and hash from a prefixedHash
	 * @param string $prefixedHash
	 * @return null|array Null if the hash is not prefixed, otherwise array('version' => 1, 'hash' => 'foo')
	 */
	protected function splitHash($prefixedHash) {
		$explodedString = \explode('|', $prefixedHash, 2);
		if (\sizeof($explodedString) === 2) {

I don’t think the hasher version will change any time soon.

cornelinux · August 16, 2018, 7:07am

Thanks a lot for the link!
I was searching in the source code but was not able to find this.