I noticed that there are mentions of BCRYPT and SHA512 in app/code/core/Mage/Core/Model/Encryption.php.
const HASH_VERSION_MD5 = 0;
const HASH_VERSION_SHA512 = 2;
/**
* Encryption method bcrypt
*/
const HASH_VERSION_LATEST = 3;
/**
* Generate hash for customer password
*
* @param string $password
* @param mixed $salt
* @return string
*/
public function getHashPassword($password, $salt = null)
{
if (is_integer($salt)) {
$salt = $this->_helper->getRandomString($salt);
}
return (bool) $salt
? $this->hash($salt . $password, $this->_helper->getVersionHash($this)) . ':' . $salt
: $this->hash($password, $this->_helper->getVersionHash($this));
}/**
* Validate hash against hashing method (with or without salt)
*
* @param string $password
* @param string $hash
* @return bool
* @throws Exception
*/
public function validateHash($password, $hash)
{
return $this->validateHashByVersion($password, $hash, self::HASH_VERSION_LATEST)
|| $this->validateHashByVersion($password, $hash, self::HASH_VERSION_SHA512)
|| $this->validateHashByVersion($password, $hash, self::HASH_VERSION_MD5);
}
/**
* Validate hash by specified version
*
* @param string $password
* @param string $hash
* @param int $version
* @return bool
*/
public function validateHashByVersion($password, $hash, $version = self::HASH_VERSION_MD5)
{
if ($version == self::HASH_VERSION_LATEST && $version == $this->_helper->getVersionHash($this)) {
return password_verify($password, $hash);
}
// look for salt
$hashArr = explode(':', $hash, 2);
if (1 === count($hashArr)) {
return hash_equals($this->hash($password, $version), $hash);
}
list($hash, $salt) = $hashArr;
return hash_equals($this->hash($salt . $password, $version), $hash);
}Am I correct, is this encrypting new customer's passwords with bcrypt now? This is kind of missed in patch notes, but is really good news!
