Re: Membership site
| From: | John Black | Date: | Thu, 28 Jul 2011 09:18:05 +0000 |
| Subject: | Re: Membership site | ||
| References: | 1 2 3 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-314226@lists.php.net to get a copy of this message | ||
On 28.07.2011 11:13, John Black wrote:
This approach makes it impractical to bruteforce the hash because every single test will have to run md5() 3000 times before it can validate a single hash. -- JohnI am sorry, I made a mistake here, 3000 times is not enough for this. The actual code for the md5 portion looks like this: $this->hash_rounds['md5'] = 3000; for( $x=0 ; $x < $this->hash_rounds['md5'] ; ++$x) { $hash = md5($salt.md5($salt.$hash).md5($hash.$salt)); } -- John