Moving away from MD5: Where to declare the custom global $wp_hasher?

Question

I want to move away from using MD5 for hashing passwords in the database. The plan is to declare a custom global $wp_hasher as hinted at in the docs for wp hash password():

Unless the global $wp_hasher is set, the default implementation uses PasswordHash, which adds salt to the password and hashes it with 8 passes of MD5.

I want to declare $wp_hasher like this (Blowfish or extended DES, 16 rounds of hashing):

global $wp_hasher;
$wp_hasher = new PasswordHash(16, FALSE);

Where do I put this code so that the custom $wp_hasher is declared by the time it's referenced in wp_hash_password()?

Answer 1

What I would do is this: Since wp_hash_password() is a "pluggable" function, create a simple plugin or MU-Plugin and define a function called wp_hash_password() in that plugin/mu-plugin. Wordpress will use your function instead of the core function.

Just copy the original code into your plugin/mu-plugin and change the one relevant line.

Answer 2

Too late to answer but for someone still looking for a solution ->

Create a plugin and write below code:

    function wp_hash_password( $password ) {
      global $wp_hasher;
      require_once( ABSPATH . WPINC . '/class-phpass.php' );
      $wp_hasher = new PasswordHash( 16, false );  
      return $wp_hasher->HashPassword( trim( $password ) );
    }