From f2de6c15ca2fe4452df6eccb2cdbb54783777644 Mon Sep 17 00:00:00 2001
From: John Blackbourn <johnbillion@git.wordpress.org>
Date: Mon, 3 Mar 2025 09:51:22 +0000
Subject: [PATCH] Security: Reduce the length of the hash returned by
 `wp_fast_hash()` so it can be used in the `user_activation_key` field when a
 legacy database schema is still in use.

This reduces the hash length from 32 bytes to 30 so the overall length of an activation key after encoding, prefixing, and prepending a timestamp fits into 60 bytes.

A key is also introduced for domain separation. This doesn't affect the output length.

Props dd32, paragoninitiativeenterprises, peterwilsoncc, johnbillion

Fixes #21022
Built from https://develop.svn.wordpress.org/trunk@59904


git-svn-id: http://core.svn.wordpress.org/trunk@59246 1a063a9b-81f0-0310-95a4-ce76da25c4cd
---
 wp-includes/functions.php | 3 ++-
 wp-includes/version.php   | 2 +-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/wp-includes/functions.php b/wp-includes/functions.php
index 9a6938ed64..5696852f52 100644
--- a/wp-includes/functions.php
+++ b/wp-includes/functions.php
@@ -9142,7 +9142,8 @@ function wp_fast_hash(
 	#[\SensitiveParameter]
 	string $message
 ): string {
-	return '$generic$' . sodium_bin2hex( sodium_crypto_generichash( $message ) );
+	$hashed = sodium_crypto_generichash( $message, 'wp_fast_hash_6.8+', 30 );
+	return '$generic$' . sodium_bin2base64( $hashed, SODIUM_BASE64_VARIANT_URLSAFE_NO_PADDING );
 }
 
 /**
diff --git a/wp-includes/version.php b/wp-includes/version.php
index 1b06df4154..de97dde903 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -16,7 +16,7 @@
  *
  * @global string $wp_version
  */
-$wp_version = '6.8-alpha-59903';
+$wp_version = '6.8-alpha-59904';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.