Member Avatar for xylude

I need to replicate the encryption shown below:

def self.encrypt(password, salt)
    Digest::SHA1.hexdigest("--#{salt}--#{password}--")
end

I am trying something like this to no avail:

$salt = 'edc93eaf81aa1d64368c35213f192bb4ea81d20d';
$password = $_POST['input'];
$password = sha1($salt.$password);
		
echo "password sha1 value: " . $password;
  • 3 Contributors
  • 4 Replies
  • 565 Views
  • 2 Weeks Discussion Span
  • Latest Post Latest Post by ruby_rocks

Dani AI

Generated

Short version: the Ruby line builds the literal string consisting of two hyphens, the salt, two hyphens, the password, and two hyphens, then takes the SHA1 hex of that string. As pointed out, the -- are just characters and #{…} injects variables into the string. To get the same result in PHP you must build exactly the same pre-image before hashing.

// build the same pre-image and get the hex digest
$plain = '--' . $salt . '--' . $password . '--';
$hash  = sha1($plain);

// or using double-quoted interpolation
$hash  = sha1("--{$salt}--{$password}--");

Troubleshooting if the values still don't match:

  • Don’t accidentally overwrite your original input (use a separate $hash variable).
  • Trim and verify the raw inputs (trim()), and check there are no hidden CR/LF or encoding differences (UTF-8 vs other encodings).
  • Confirm the exact salt used by the Ruby app — Rails apps sometimes generate or store salts differently (see ’s note about Rails salts).
  • Note: PHP’s sha1() returns lowercase hex, same as Ruby’s hexdigest, so case won’t be the issue.

Security note: SHA1 with a single round is not recommended for password storage today. For new work use PHP’s password_hash() / password_verify() (bcrypt/argon2) or a well-tested KDF (PBKDF2/Argon2) instead of rolling your own SHA1 scheme.

Recommended Answers

All 4 Replies

Member Avatar for xylude

Or even if anyone could help me with what "--#" and "--" means in ruby it would help loads. I'm assuming that anything wrapped in curly brackets '{}' is a variable.

Member Avatar for tiger86

I need to replicate the encryption shown below:

def self.encrypt(password, salt)
    Digest::SHA1.hexdigest("--#{salt}--#{password}--")
end

I am trying something like this to no avail:

$salt = 'edc93eaf81aa1d64368c35213f192bb4ea81d20d';
$password = $_POST['input'];
$password = sha1($salt.$password);
		
echo "password sha1 value: " . $password;

Ruby on rails has a built in method and if I remember it correctly it is self.salt . You can always google ruby on rails salt if you'd like.

Member Avatar for ruby_rocks

, In response to your question about what -- and #{} mean in Ruby, in your example those hyphens or dashes are just part of a string. "--" is just two hyphens, not ruby code. The important part is in the #{}. The pound sign followed by curly braces is used for interpolating variables and evaluating expressions within strings. E.g.

var1 = "some string"
var2 = "String then interpolating a variable #{ var1 }"

In addition to interpolating variables, you can also evaluate expressions inside the #{ }. E.g.

var = "some string"
expression_in_string = "Var reversed: #{ var.reverse}, now in caps: #{ var.upcase }"
Member Avatar for ruby_rocks

, what exactly is failing in your php code? It works fine for me using the php -a interactive shell on Macbook Pro, Leopard. Maybe try pasting your entire php function code into the thread?

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.