Blowfish authentication in cakephp 2.4.2 - cakephp

Question

Can anybody help me with cakephp 2.4.2 auth using blowfish, I'm new to cakephp auth so I've googled it up but didn't find any solution for my problem.
Here is my code
For App Controller
public $components = array(
'Session',
'RequestHandler',
'Auth' => array(
'authenticate' => array(
'Form' => array(
'passwordHasher' => 'Blowfish'
)
)
)
);
For Model
public function beforeSave($options = array()){
if (isset($this->data[$this->name]['password'])) {
$this->data[$this->name]['password'] = Security::hash($this->data[$this->alias]['password'], 'blowfish');
}
return true;
}
For Controller
if ($this->Auth->login()) {
$this->redirect(array('controller' => 'admins', 'action' => 'dashboard', 'builder' => true));
} else {
$this->Session->write('flash', array('You Have entered wrong username or password.', 'failure'));
$this->redirect(array('controller' => 'users', 'action' => 'login', 'builder' => true));
}

Answer 1

For blowfish you need to provide a salt, that is a bcrypt salt
from docs
http://book.cakephp.org/2.0/en/core-utility-libraries/security.html#Security::hash
// Create a hash using bcrypt
Security::setHash('blowfish');
$salt = Security::hash(Configure::read('Security.salt'));
// $salt is a previously generated bcrypt salt.
$passwordHash = Security::hash($password, 'blowfish', $salt);
I would recommend using separate salt for each user/password, in that case instead of using security salt for creating the bcrypt salt, use some random string, and then save the salt in your database along with password hash.
during user login use this scenario
1) fetch the salt and the password hash from database
2) using salt and the plain text password provided by user during login to generate the password hash
3) compare newly generated password hash with what was fetched from the db.
4) if they match login the user, otherwise show error
for login use if ($this->Auth->login($userData)) { and $userData should be array like
array ('username' => 'the_username', 'password' => 'the_password');
authentication:
$userData = $this->User->findByEmail('myEmail#gmail.com', array('username', 'password', 'salt'));
$passwordHash = Security::hash($userPlainTextPassword, 'blowfish', $userData['User']['salt']);
if ($passwordHash == $userData['User']['password']) {
if ( $this->Auth->login($userData['User'])) {
// ok
} else {
// smth wrong
}
} else {
// wrong username or password
}
btw, for comparing the hashes you better use standard time comparison, read more here
https://crackstation.net/hashing-security.htm#properhashing

Answer 2

Try this in your AppController:
$this->Auth->authenticate = array(
AuthComponent::ALL => array(
'userModel' => 'User',
'fields' => array(
'username' => 'email',
'password' => 'password'
),
'scope' => $user_scope,
), 'Form'=> array(
'passwordHasher' => 'Blowfish'
)
);