Limiting the length of a Hash in Laravel - laravel

Question

I am using the Laravel Hash Facade to generate a hash. This is then passed to a 3rd party service which uses the same hash in a callback. I use this to ensure that the request is "trusted". However, the Hash::make() creates a 60 character long string, but the 3rd party service only allows 32 characters.
If I apply md5() to the hash, I won't be able to use the Hash::check(). If i use substr(), then two - or more - hashes can result in the same string.
What is the best way to handle this scenario, in a secure way?

Answer 1

By default, Laravel Hash uses the password_hash() function with the BLOWFISH cypher, which generates the 60 character result. The 60 character result, however, is actually 28 characters of parameters, and the resulting 32 character hash.
The first 28 characters consists of the 4 character prefix ($2y$), the 2 digit cost (04 - 31), and the 22 character salt. If you store this first 28 characters in your application somewhere (ex. .env file), you can use it to check the 32 character hashes you generate and receive from the third party.
The password_hash() function is a built-in wrapper around the crypt() function, but it generates it's own salt dynamically. Since Laravel doesn't provide a way to provide the salt manually, you won't be able to use the Hash::make() method; you'll need to use the crypt() method directly, and pass in the proper data to trigger using the BLOWFISH cipher with your static salt. The generated results are still compatible with the password_verify() function, though, so you will still be able to use Hash::check() to verify the received hash (or just use password_verify() directly).
Below is hopefully a more helpful illustration with code and comments.
// This tells crypt() to use the BLOWFISH cypher
$prefix = '$2y$';
// This tells crypt() the number of rounds for the BLOWFISH algorithm to use.
// The higher the number, the longer it takes to generate a hash (good).
// Value must be two digits and between 04 and 31. 10 is default.
$cost = '10';
// This is the 22 character salt (including start and end dollar signs). This is
// the value normally dynamically generated by password_hash(), but you
// are storing a static value in your application.
$salt = '$thisisahardcodedsalt$';
// Concat the three parameters to generate the full 28 character BLOWFISH
// prefix. Instead of using the hardcoded variables above, you would
// probably just get the value out of the config (set by .env file).
$blowfishPrefix = $prefix.$cost.$salt;
// I don't know where your password is coming from, but this is the password
// that you were planning on using for your Hash::make() and Hash::check()
// calls.
$password = 'This is your password.';
// Hash the password to get your 60 character BLOWFISH cipher result.
$hash = crypt($password, $blowfishPrefix);
// The real hash is the last 32 characters. This is the value you pass to your
// third party service.
$hashToThirdParty = substr($hash, -32);
// Now we've generated a hash and sent it to the third party. Now we wait.
// ... at some point, the third party sends the hash back to you.
$hashFromThirdParty = $hashToThirdParty;
// Add your stored BLOWFISH prefix to the hash received from the third party,
// and pass the result into Hash::check() (along with your password).
$verified = Hash::check($password, $blowfishPrefix.$hashFromThirdParty);
// Since we're not using Hash::make() to generate the password, you may not care
// about using Hash::check() to check it. You can just use the underlying
// password_verify() function at this point, if you want.
$altVerified = password_verify($password, $blowfishPrefix.$hashFromThirdParty);
PHP function resources:
password_hash()
crypt()
password_verify()
Laravel code resources:
Hash::make() for the bcrypt hasher
Hash::check() for the bcrypt hasher