Hey everyone, I’m currently writing my Bachelor’s thesis, which is actually a continuation of a project started by a previous student. Their work covered several other cryptographic primitives and the whole thing was built in Laravel, so I’m stuck implementing BCrypt in pure PHP to keep everything consistent within that same codebase.

The main issue is that BCrypt is fundamentally built on 32-bit unsigned integer math, but modern PHP uses 64-bit signed integers. I’m having a hard time figuring out the cleanest way to handle the overflows so that the variables wrap around exactly like they would in C. If they don't, the internal state of the P-array and S-boxes gets totally messed up.

I’ve been looking at a few ways to handle this. One option is to just use bitwise masks like & 0xFFFFFFFF after every single addition, XOR, or shift. It seems like the most direct way to force a 32-bit state, but I’m worried my code is going to look like a total mess of masks for my final submission.…