note 83079 added to function.sha1
| From: | ranko84 at gmail dot com | Date: | Fri, 09 May 2008 02:12:34 +0000 |
| Subject: | note 83079 added to function.sha1 | ||
| Groups: | php.notes | ||
| Request: | Send a blank email to php-notes+get-139201@lists.php.net to get a copy of this message | ||
Thanks for the feedback. This should do the trick, I hope.
I think that I haven't understood this sentence completely "In this case you will need the
salt to reside in the database along with the username and password." As in, were you refering
to previous method, this method or this function.
Salt already resides in database along with username, password, or any string you decide to hash.
This function just scrambles it depending on length of string (password) user enters so that
attacker has trouble finding out what is salt and what is hash, if attacker even suspects that there
is salt (reasons behind $keepLength, or defining $hSLength where you could set it to 24 leading
attacker to believe he's facing sha256, not sha1).
<?php
function obscure ($hString, $hDecode = NULL, $hSLength = 10, $keepLength = NULL, $minhPass = 10,
$hMethod = sha1)
{
if ($hDecode == NULL)
{
for ($i = 0; $i<16; $i++)
{
$hSalt = rand(33, 255);
$hRandomSalt .= chr($hSalt);
}
$hRandomSalt = hash($hMethod, $hRandomSalt);
}
else
{
$hRandomSalt = $hDecode;
}
if ($keepLength != NULL)
{
if ($hSLength > (strlen($hRandomSalt) - $minhPass))
{
$hSLength = (strlen($hRandomSalt) - $minhPass);
}
}
else if ($hSLength < 0)
{
$hSLength = 0;
}
$hLPosition = strlen($hString);
while ($hLPosition > $hSLength)
{
$hNumber = substr($hLPosition, -1);
$hLPosition = $hLPosition * ($hNumber/10);
}
$hLPosition = (integer)$hLPosition;
$hRPosition = $hSLength - $hLPosition;
$hFSalt = substr($hRandomSalt, 0, $hLPosition);
$hLSalt = substr($hRandomSalt, -$hRPosition, $hRPosition);
$hPassHash = hash($hMethod, ($hLSalt . $hString . $hFSalt));
if ($keepLength != NULL)
{
if ($hSLength != 0)
{
$hPassHash = substr($hPassHash, $hLPosition, -$hRPosition);
}
}
return $hFSalt . $hPassHash . $hLSalt;
}
?>
----
Server IP: 69.147.83.197
Probable Submitter: 78.1.141.243
----
Manual Page -- http://www.php.net/manual/en/function.sha1.php
Edit -- https://master.php.net/note/edit/83079
Del: integrated -- https://master.php.net/note/delete/83079/integrated
Del: useless -- https://master.php.net/note/delete/83079/useless
Del: bad code -- https://master.php.net/note/delete/83079/bad+code
Del: spam -- https://master.php.net/note/delete/83079/spam
Del: non-english -- https://master.php.net/note/delete/83079/non-english
Del: in docs -- https://master.php.net/note/delete/83079/in+docs
Del: other reasons-- https://master.php.net/note/delete/83079
Reject -- https://master.php.net/note/reject/83079
Search -- https://master.php.net/manage/user-notes.php