title: How can I vendorize bcrypt in a PHP application (and should I)?
body: <p>I am contributing to a relatively mature open-source PHP project.  Recently, I discovered that it stores passwords as plain MD5 hashes, which is quite bothersome to me.  I figured that if I was going to fix it, I might as well Do It Right(tm), so I wanted to use bcrypt.</p>
  <p>First, what I have found for other languages: <a href="http://bcrypt-ruby.rubyforge.org/" rel="noreferrer">bcrypt-ruby</a> appears to use either the original C code from OpenBSD or <a href="http://www.mindrot.org/projects/jBCrypt/" rel="noreferrer">jBCrypt</a>'s java code.  <a href="http://www.mindrot.org/projects/py-bcrypt/" rel="noreferrer">py-bcrypt</a> is a thin wrapper around the BSD code.  <a href="http://derekslager.com/blog/posts/2007/10/bcrypt-dotnet-strong-password-hashing-for-dotnet-and-mono.ashx" rel="noreferrer">BCrypt.net</a> is a direct port of <a href="http://www.mindrot.org/projects/jBCrypt/" rel="noreferrer">jBCrypt</a>.</p>
  <p>Now, PHP itself supports bcrypt (albeit, misleadingly called simply 'blowfish') in <a href="http://php.net/manual/en/function.crypt.php" rel="noreferrer">the crypt function</a>.  However, versions prior to 5.3 require support on the system itself, generally provided by <a href="http://www.openwall.com/crypt/" rel="noreferrer">crypt_blowfish</a>.  <a href="http://www.openwall.com/phpass/" rel="noreferrer">phpass</a> is the same, and recommends installing either PHP 5.3 or <a href="http://www.hardened-php.net/" rel="noreferrer">Suhosin</a>.</p>
  <p>Since many users of the application use standard shared hosting, I don't want to require any special configuration of the server.  I was hoping to just steal the code from PHP's 5.3 release, but it is in C, and (from the small bit of reading I've just done) I cannot require the use of a C-extension for the project's users.</p>
  <p>I thought of just creating a pure-PHP port of bcrypt, but looking at <a href="http://github.com/codahale/bcrypt-ruby/blob/master/ext/jruby/bcrypt_jruby/BCrypt.java" rel="noreferrer">the source of jBCrypt</a>, I am not sure that I should, given that I'm not incredibly familiar with either PHP or blowfish, and a mistake here could be simultaneously dangerous and difficult to detect in the first place.</p>
  <p>So, I present to you two (multipart) questions:</p>
  <ol>
  <li>Is my lack of PHP knowledge getting the best of me?  Can I really use one of the already-created implementations?</li>
  <li>Should I instead just create a simple loooping function that calls <code>sha1()</code> or <code>md5()</code> repeatedly for some configurable number of times?</li>
  </ol>