Authentication and keeping information secure is my goal with writing my Authentication class while making sure it is extendable completely as possible over making it usable for anything over just hashing passwords.
I believe I have made it simple as possible to allow it to hold its own as a class by itself for hashing, generating strings, and making sure that the majority of the data that will be passed through the class is secure as possible.
<?php
/**
* Package: reAuth Class
* Authros: Traven West
* Created: June 2014
**/
/**
* Base Authentication Class
* Returns, generates, and hashes string values securely with proven
* algorithms and class structure.
**/
class Authentication {
// Information for this authentication object
protected $_data = array();
// The object used to generate salts and passwords
protected $_hashFunction;
// Authentication key object
protected $_authKey = 'PS1eFzMWSGImNOhFfdAliW9maPPm6t4TJBGW31yViVVP9WC0umF6l2F3TOD0kkZj';
public function __construct() {
$this->_authKey = $authKey;
$this->_setupHash() = $hashMethod;
// Sets the authentication as sha512/sha256
$authKey = $hashMethod();
return $authKey;
}
protected function _setupHash() {
if($this->_hashFunction) {
return;
}
if(extension_loaded('hash')) {
// Default hashing algorithm
$this->_hashFunction = 'sha512';
}
else {
// Backup option if not sha512 not supported
$this->_hashFunction = 'sha256';
}
}
// Perform the generation of the hash based on the function set
protected function generateHash($data) {
$this->_setupHash();
switch($this->_hashFunction) {
case 'sha512':
return hash('sha512', $data);
case 'sha256':
return hash('sha256', $data);
default:
$message = 'Unknown hash type.'
throw new Exception($message);
}
}
}
I strongly believe that SHA512
is supported on all machines now, but I do have to allow the occasion that it may not and revert back to SHA256
. Another goal is to create a 64-bit
string as the output, if not longer.
$authKey
and$hashMethod
supposed to be constructor args? The statement$this->_setupHash() = $hashMethod;
is illegal since you cannot write to a function's return value. Why don't you use_authKey
or_data
in the class? – David Harkness Jun 29 at 7:29