[Python] Hash algorithm Python Passlib to PHP Passlib, why don't they match?

In a database I have the password hash value:

$pbkdf2-sha512$600000$aI2RMiaE8N6bE0JIaS3FmA$T3whDDJKetOQoCgatvKtno1oEQJjCfcwa9U08fzczcnWk5taHuQRU4g/0Gi7VhmnH2RNzHm22gUndBSpxDr0ow


the plaintext value is home1234

However when I attempt to decypher this, I can't seem to get the same hash returned, and I am not sure why.

According to the spec for Passlib (and Phpasslib) is the format:

$algorithm$rounds$salt$hash

so for my above password hash:

algorithm = pbkdf2-sha512
rounds = 600000
salt = aI2RMiaE8N6bE0JIaS3FmA
resultant hash = T3whDDJKetOQoCgatvKtno1oEQJjCfcwa9U08fzczcnWk5taHuQRU4g/0Gi7VhmnH2RNzHm22gUndBSpxDr0ow


however when I attempt to use these configuration parameters below in a PHP script, I get a totally different hash for this password:

$salt = "aI2RMiaE8N6bE0JIaS3FmA";
$iterations = 600000;

$password = "home1234";

$configarray = array('digest' => 'sha512', 'rounds' => $iterations, 'salt' => $salt);

$genedconfig = \PHPassLib\Hash\PBKDF2::genConfig($configarray);

$passlib_hash = \PHPassLib\Hash\PBKDF2::hash($password, $genedconfig);

echo("<br/><br/>Passlib Hash: ".$passlib_hash);



which outputs:

Passlib Hash: $pbkdf2-sha512$600000$aI2RMiaE8N6bE0JIaS3FmA$3cg9HdAb6qDBw0XVklqlYVBqZ7t6P0zVGAPwXkmRiAJA.IuGxOWRXzz.QjOBKJcN3lpk91XsNSEnTjeaFn7cVw


As you can see, the hash is completely different. :/

I was expecting the hash to be the same as the hash from the database, given the exact parameters, and using PHPasslib which is a PHP library inspired by the Python Passlib library.

Continue reading...