note 86067 added to function.md5

This is partly in response to postfix at bk dot ru, concerning rainbow tables and the security of md5 as a password hash. The idea behind rainbow tables is to, over time, create a database that contains all the possible md5 hashes. They don't need to contain every possible *password* because if they find a 3 letter word that produces the same hash (known as a "collision") as your 46 digit, alpha-numeric password that includes english, russian, and japanese characters... they can just use the 3 digit one instead. Now I'm not certain, but I think that with regular md5 hashes (unsalted) there is already a complete rainbow table in existence. This is why salts are useful. Adding a salt to the password before hashing it forces attackers to create a brand new rainbow table, because the existing ones are useless. And if you go a step further with a script that uses a different salt for each user, they can only crack one password at a time. And speaking of time... that is another important factor. The quicker a computer is able to hash a password, the more passwords it can try per second. A simple md5, for instance, can be calculated several hundred times per second on an average server. If, however, your script hashes the password 2,000 times, it will take a brute force attack at least 5 seconds per password (which means it would take roughly 33,109 years to run every 8 digit password using only lower case letters). So... straight md5 = practically plain-text to a determined attacker. Unique salts, and more server intensive hashes = a long life of boredom to a determined attacker. ---- Server IP: 64.71.164.2 Probable Submitter: 75.173.199.89 ---- Manual Page -- http://www.php.net/manual/en/function.md5.php Edit -- https://master.php.net/note/edit/86067 Del: integrated -- https://master.php.net/note/delete/86067/integrated Del: useless -- https://master.php.net/note/delete/86067/useless Del: bad code -- https://master.php.net/note/delete/86067/bad+code Del: spam -- https://master.php.net/note/delete/86067/spam Del: non-english -- https://master.php.net/note/delete/86067/non-english Del: in docs -- https://master.php.net/note/delete/86067/in+docs Del: other reasons-- https://master.php.net/note/delete/86067 Reject -- https://master.php.net/note/reject/86067 Search -- https://master.php.net/manage/user-notes.php