Re: JScript MD5 function? (WAS "authorization idea (good or bad?)")
| From: | Dean Hall | Date: | Thu, 05 Oct 2000 08:45:43 +0000 |
| Subject: | Re: JScript MD5 function? (WAS "authorization idea (good or bad?)") | ||
| References: | 1 | Groups: | php.db |
| Request: | Send a blank email to php-db+get-3339@lists.php.net to get a copy of this message | ||
> Is there a JavaScript function that will do an MD5 on the client before
> sending it to the server?
>
> Would this (send MD5 passwords) actually help?
> (Can't a 'hack' capture and send the MD5 data just as easily as the
> cleartext?)
You can get an Javascript version of the MD5 cryptographic hash function
from <http://www.apt7.com/js/md5.js>. It's
from the Horde project, but this
one's my own personal copy of it.
Yes, if you simply md5'ed a password when the user sent it, authentication
would be easily crackable. What I do for my sessions is this:
When they go to the login page, I generate some cryptographically unique
string -- like the millisecond time, for instance. I send this with the
login page as a hidden form element. Then, I have a JavaScript function that
executes before the form is submitted. The function appends the value of
this hidden form element to the end of the plaintext password and THEN runs
MD5 on the string.
Then the PHP page that handles the login gets the value of the hidden form
element, gets the user's password from the database, combines them and runs
md5 on them. This is compared to the password hash that was sent.
This makes sure that every time a user logs in, a DIFFERENT password hash is
sent. Even if someone knew exactly what I was doing (which I must assume,
because all the javascript is easily read on the client), they still
couldn't crack the system unless they could either crack md5 (which may be
possible considering recently found exploits for md5) or find out the user's
password. If the cracker knew the user's password, they could log in anyway.
Here's a little sample of what I do:
<script src="js/md5.js">
</script>
<script language="JavaScript">
<!-- //
function submitLogin() {
if(document.login.username.value == "") {
alert("Please type your username.");
return false;
}
if(document.login.password.value == "") {
alert("Please type your password.");
return false;
}
document.login.pass_hash.value =
MD5(document.login.password.value + document.login.mstime.value);
document.login.password.value = "";
return true;
}
// -->
</script>
<form method="POST" action="login.php" name="login">
<!-- The value of this element should be determined and -->
<!-- written by getting millisecond time or some other -->
<!-- cryptographically unique value -- a one-time pad -->
<input type="hidden" name="mstime" value="xxx">
<input type="hidden" name="pass_hash" value="">
Username: <input type="text" size="32" name="username"
value=""><br>
Password: <input type="password" size="32" name="password"
value=""><br>
<input type="submit" value="Log In" onClick="submitLogin();
return(false);">
</form>
If you see any flaws in this HTML page or in my authentication system, let
me know.
Of course, the best way to do all this would be over SSL. :-)
Dean.
http://www.apt7.com