6 replies to this topic

[KevinM1]

http://arstechnica.c...sier-than-ever/

Like MD5, SHA1 was never really intended to be used as a hash for passwords. Use SHA512, bcrypt, or any of the slower hashes that take multiple passes over a string. Use salt. Use phpass rather than rolling your own: http://www.openwall.com/phpass/

[Beeeeney]

I know some of those words.

[Hall of Famer]

Well in my script I first use md5 on the raw password, then apply sha1 on the combined username and md5'd password. Finally the new string is concatenated with salt and pepper, a sha512 function is then acted on the combined string to give a final result. The difference between pepper and salt is that the former is hard coded for each site/application, while salt is user-specific and alterable. Heres the way I did it lol:

public function encrypt($username, $password, $salt){
$config = Registry::get("config");
$pepper = $config->peppercode;
$password = md5($password);
$newpassword = sha1($username.$password);
$finalpassword = hash('sha512', $pepper.$newpassword.$salt);
return $finalpassword;
}

Kinda weird isnt it?

Edited by Hall of Famer, 05 December 2012 - 10:39 AM.

[RobertP]

you could just use the native crypt function..

blowfish implementation

    private function encrypt($string, $salt) {
        if (strlen($salt) < 21)
            trigger_error('Member#encrypt: Failed due to salt length less then 21.', E_USER_ERROR);
        return crypt($string, '$2y$10$' . $salt . '$');
    }

Edited by RobertP, 05 December 2012 - 08:31 PM.

[Amplivyn]

I was using sha1... must change...

Just wondering though, are there any specific PHP security books you guys recommend?

[Christian F.]

Not PHP specific, but Innocent Code is highly recommended for all web developers. Though, we're moving a bit off-topic here, so I suggest starting a new thread for this, if there isn't one already, in the right section.

[Stefany93]

Opencart uses SHA1 for storing passwords. I was a bit shocked when I saw that since that hashing algorithm is now obsolete.

Edited by Stefany93, 15 December 2012 - 04:12 AM.