| Subject: | EncodedColumn can't validate with Digest::Whirlpool ( at all ) |
When using Whirlpool as the algorithm, hashing, even without a salt,
results in incorrect values.
This appears as if the same digester is being used without resetting it
between encodes, so every call to the encoder is really the hash of (
$previously_hashed_data . $newdata ), which of course is nonsense for
passwords.
This makes it impossible to encode a password and validate it.
The following code never validates, and perpetually results in
check_password always returning false, and the hash of the stored
password continually rotating, despite there being no salt. ( As
exhibited by the attached output:
http://gist.github.com/207643
Further inspection by paraphrasing the encode column method into a more
comprehensive test demonstrates Whirlpool doesn't function like the rest
of the family ( for whatever reason ).
http://gist.github.com/207648
All tested algorithms emit "TRUE" validity, except for Whirlpool, which
only ever emits "FALSE".