Password Hashing Best Practices

<?php
// SIKKER KODE - Best practices for password hashing

// 1. ANBEFALET: Brug password_hash() med Argon2id
$password = $_POST['password'] ?? '';

// Validér password strength først
if (strlen($password) < 12) {
    die("Password must be at least 12 characters");
}

// Argon2id er den mest sikre algoritme (modstår både side-channel og GPU-angreb)
$hashed_password = password_hash($password, PASSWORD_ARGON2ID, [
    'memory_cost' => 65536,  // 64 MB
    'time_cost' => 4,         // 4 iterations
    'threads' => 3            // 3 parallel threads
]);

// Gem i database
$stmt = $pdo->prepare("INSERT INTO users (username, password, created_at) VALUES (?, ?, NOW())");
$stmt->execute([$username, $hashed_password]);

// password_hash() genererer automatisk et kryptografisk sikkert salt
// og inkluderer det i output-stringen

// 2. ALTERNATIV: Bcrypt (god kompatibilitet)
$password = $_POST['password'] ?? '';

// Bcrypt med passende cost factor
$hashed_password = password_hash($password, PASSWORD_BCRYPT, [
    'cost' => 12  // Juster baseret på din servers ydelse
]);

// Test hashing-tid (burde være 100-350ms)
$start = microtime(true);
password_hash('test_password', PASSWORD_BCRYPT, ['cost' => 12]);
$time = (microtime(true) - $start) * 1000;
echo "Hashing time: {$time}ms\n";

// 3. Password verification med password_verify()
$input_password = $_POST['password'] ?? '';
$username = $_POST['username'] ?? '';

// Hent bruger fra database
$stmt = $pdo->prepare("SELECT id, username, password FROM users WHERE username = ?");
$stmt->execute([$username]);
$user = $stmt->fetch(PDO::FETCH_ASSOC);

if (!$user) {
    // Timing-safe failure
    password_hash($input_password, PASSWORD_ARGON2ID);
    die("Invalid credentials");
}

// password_verify() er timing-safe
if (password_verify($input_password, $user['password'])) {
    // Login successful
    echo "Login successful";
    
    // Check om password skal rehashes
    if (password_needs_rehash($user['password'], PASSWORD_ARGON2ID, [
        'memory_cost' => 65536,
        'time_cost' => 4,
        'threads' => 3
    ])) {
        // Rehash med nye parametre
        $new_hash = password_hash($input_password, PASSWORD_ARGON2ID, [
            'memory_cost' => 65536,
            'time_cost' => 4,
            'threads' => 3
        ]);
        
        $stmt = $pdo->prepare("UPDATE users SET password = ? WHERE id = ?");
        $stmt->execute([$new_hash, $user['id']]);
    }
} else {
    die("Invalid credentials");
}

// 4. AVANCERET: Password hashing med pepper
class SecurePasswordHasher {
    private $pepper;
    
    public function __construct() {
        // Pepper gemmes som miljøvariabel, IKKE i database
        $this->pepper = getenv('PASSWORD_PEPPER');
        if (!$this->pepper) {
            throw new Exception("Pepper not configured");
        }
    }
    
    public function hash($password) {
        // Kombiner password med pepper før hashing
        $peppered = hash_hmac('sha256', $password, $this->pepper);
        
        return password_hash($peppered, PASSWORD_ARGON2ID, [
            'memory_cost' => 65536,
            'time_cost' => 4,
            'threads' => 3
        ]);
    }
    
    public function verify($password, $hash) {
        $peppered = hash_hmac('sha256', $password, $this->pepper);
        return password_verify($peppered, $hash);
    }
}

$hasher = new SecurePasswordHasher();

// Registration
$password = $_POST['password'] ?? '';
$hashed = $hasher->hash($password);
$stmt = $pdo->prepare("INSERT INTO users (password) VALUES (?)");
$stmt->execute([$hashed]);

// Login
$input_password = $_POST['password'] ?? '';
$stmt = $pdo->prepare("SELECT password FROM users WHERE username = ?");
$stmt->execute([$username]);
$user = $stmt->fetch();

if ($user && $hasher->verify($input_password, $user['password'])) {
    echo "Login successful";
}

// 5. Password strength validation
function validatePasswordStrength($password) {
    $errors = [];
    
    if (strlen($password) < 12) {
        $errors[] = "Password must be at least 12 characters";
    }
    
    if (!preg_match('/[A-Z]/', $password)) {
        $errors[] = "Password must contain at least one uppercase letter";
    }
    
    if (!preg_match('/[a-z]/', $password)) {
        $errors[] = "Password must contain at least one lowercase letter";
    }
    
    if (!preg_match('/[0-9]/', $password)) {
        $errors[] = "Password must contain at least one number";
    }
    
    if (!preg_match('/[^A-Za-z0-9]/', $password)) {
        $errors[] = "Password must contain at least one special character";
    }
    
    // Check for common passwords
    $common_passwords = file('common-passwords.txt', FILE_IGNORE_NEW_LINES);
    if (in_array(strtolower($password), $common_passwords, true)) {
        $errors[] = "Password is too common";
    }
    
    return $errors;
}

// 6. Secure password reset med temporary token
function generatePasswordResetToken() {
    return bin2hex(random_bytes(32));
}

function createPasswordResetToken($user_id) {
    $token = generatePasswordResetToken();
    $token_hash = password_hash($token, PASSWORD_ARGON2ID);
    $expires = date('Y-m-d H:i:s', strtotime('+1 hour'));
    
    $stmt = $pdo->prepare(
        "INSERT INTO password_reset_tokens (user_id, token_hash, expires_at) 
         VALUES (?, ?, ?)"
    );
    $stmt->execute([$user_id, $token_hash, $expires]);
    
    return $token; // Send dette via email
}
?>