PasswordHash::crypt_private( $password, $setting )

131	function crypt_private($password, $setting)132	{133		$output = '*0';134		if (substr($setting, 0, 2) === $output) {135			$output = '*1';136		}137 138		$id = substr($setting, 0, 3);139		# We use "$P$", phpBB3 uses "$H$" for the same thing140		if ($id !== '$P$' && $id !== '$H$') {141			return $output;142		}143 144		$count_log2 = strpos($this->itoa64, $setting[3]);145		if ($count_log2 < 7 || $count_log2 > 30) {146			return $output;147		}148 149		$count = 1 << $count_log2;150 151		$salt = substr($setting, 4, 8);152		if (strlen($salt) !== 8) {153			return $output;154		}155 156		# We were kind of forced to use MD5 here since it's the only157		# cryptographic primitive that was available in all versions158		# of PHP in use.  To implement our own low-level crypto in PHP159		# would have resulted in much worse performance and160		# consequently in lower iteration counts and hashes that are161		# quicker to crack (by non-PHP code).162		$hash = md5($salt . $password, TRUE);163		do {164			$hash = md5($hash . $password, TRUE);165		} while (--$count);166 167		$output = substr($setting, 0, 12);168		$output .= $this->encode64($hash, 16);169 170		return $output;171	}
When	Instructions	Calls it makes
always	14–28	none
`!$count_log2`	47–50	`md5(), md5(), ->encode64()`
PHP	Compiled	Executed	Branches	Notes
8.6-dev	53	14–50	7
8.5	53	14–50	7
8.4	53	14–50	7	17 fewer instructions than PHP 8.3
8.3	70	21–67	7
8.2	70	21–67	7
8.1	70	21–67	7
7.4	70	21–67	7