note 89568 modified in function.hash by danbrown
| From: | danbrown@php.net | Date: | Sat, 14 Mar 2009 14:46:11 +0000 |
| Subject: | note 89568 modified in function.hash by danbrown | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-151887@lists.php.net to get a copy of this message | ||
When using hash() for storing passwords, I've found that the best practice is not to use just
one salt, but two. This example uses my preferred algorithm for passwords, whirlpool.
This way, even if someone can produce a rainbow table for your algorithm, and has the salt to do it
with, they will never know where in the hash parameter the second salt was placed, because they
don't know the length of the actual password.
<?php
function doubleSalt($toHash,$username){
$password = str_split($toHash,(strlen($toHash)/2)+1);
var_dump($password);
$hash = hash('md5', $username.$password[0].'centerSalt'.$password[1]);
return $hash;
}
?>
The str_split operation needs a +1 appended, otherwise the last character is cut off when the
password is an odd number of characters, so that pass1 and pass2 will return the same value.
[NOTE BY danbrown AT php DOT net: Bug spotted by (Sunil) on 13-Mar-2009 and fix applied by OP.]
--was--
@sunil
I found a bug in the function, thanks for pointing it out. The function should read:
<?php
function doubleSalt($toHash,$username){
$password = str_split($toHash,(strlen($toHash)/2)+1);
var_dump($password);
$hash = hash('md5', $username.$password[0].'centerSalt'.$password[1]);
return $hash;
}
?>
The str_split operation needs a +1 appended, otherwise the last character is cut off when the
password is an odd number of characters, so that pass1 and pass2 will return the same value.
http://php.net/manual/en/function.hash.php