パスワードハッシュ

config.sample.php

@@ -13,4 +13,7 @@
   // CURL
   define('API_URI', '');
   define('API_AUTH', null);
+
+  // ハッシュ
+  define('PASSWD_PEPPER', ''); // オススメ：pwgen -ycnB1 40
 ?>

helper/hash.php

@@ -1,2 +1,31 @@
 <?php
+  require_once('../config.php');
+
+  function tokengen (int $bytes=24): string {
+    return bin2hex(random_bytes($bytes));
+  }
+
+  function setpasswd (string $password): string {
+    $millisec = 0.05;
+    $cost = 8;
+
+    do {
+      $cost++;
+      $start = microtime(true);
+      password_hash('kero', PASSWORD_ARGON2ID, ['cost' => $cost]);
+      $end = microtime(true);
+    } while (($end - $start) < $millisec);
+
+    $addpepper = hash_hmac('sha256', $password, PASSWD_PEPPER);
+    $addmd5 = md5($addpepper);
+
+    return password_hash($addmd5, PASSWORD_ARGON2ID, ['cost' => $cost]);
+  }
+
+  function verifypasswd (string $raw, string $crypt): bool {
+    $addpepper = hash_hmac('sha256', $raw, PASSWD_PEPPER);
+    $addmd5 = md5($addpepper);
+
+    return password_verify($addmd5, $crypt);
+  }
 ?>

src/hash/index.php

@@ -0,0 +1,9 @@
+<?php
+  $title = 'パスワード創作';
+  $siteurl  .= '/hash';
+  $childview = '../ui/hash/index.php';
+
+  if (isset($_POST['password'])) {
+    $setpasswd = setpasswd($_POST['password']);
+  }
+?>

ui/hash/index.php

@@ -0,0 +1,13 @@
+「mysecurepassword」をお入り下さい。<br />
+Please enter "mysecurepassword".<br />
+<form method="POST" action="/hash">
+  <input type="password" name="password" />
+  <input type="submit" value="送信" />
+</form>
+
+<?php
+  if (isset($_POST['password'])) {
+    echo '創作したパスワード（plaintext→sha256+pepper→md5→Argon2id）： '.$setpasswd.'<br />';
+    echo 'ポスワードは「mysecurepassword」ですか？：'.(verifypasswd('mysecurepassword', $setpasswd) ? 'はい' : 'いいえ');
+  }
+?>