note 88057 modified in function.sha1 by danbrown

If I correctly understand what ranko84 is on about, this would be a simpler function with roughly the same result. <?php function obscure($password, $algorythm = "sha1") { // Get some random salt, or verify a salt. // Added by (grosbedo AT gmail DOT com) if ($salt == NULL) { $salt = hash($algorythm, uniqid(rand(), true)); } // Determine the length of the hash. $hash_length = strlen($salt); // Determine the length of the password. $password_length = strlen($password); // Determine the maximum length of password. This is only needed if // the user enters a very long password. In any case, the salt will // be a maximum of half the end result. The longer the hash, the // longer the password/salt can be. $password_max_length = $hash_length / 2; // Shorten the salt based on the length of the password. if ($password_length >= $password_max_length) { $salt = substr($salt, 0, $password_max_length); } else { $salt = substr($salt, 0, $password_length); } // Determine the length of the salt. $salt_length = strlen($salt); // Determine the salted hashed password. $salted_password = hash($algorythm, $salt . $password); // If we add the salt to the hashed password, we would get a hash that // is longer than a normally hashed password. We don't want that; it // would give away hints to an attacker. Because the password and the // length of the password are known, we can just throw away the first // couple of characters of the salted password. That way the salt and // the salted password together are the same length as a normally // hashed password without salt. $used_chars = ($hash_length - $salt_length) * -1; $final_result = $salt . substr($salted_password, $used_chars); return $final_result; } ?> --was-- If I correctly understand what ranko84 is on about, this would be a simpler function with roughly the same result. <?php function obscure($password, $algorythm = "sha1") { // Get some random salt. $salt = hash($algorythm, uniqid(rand(), true)); // Determine the length of the hash. $hash_length = strlen($salt); // Determine the length of the password. $password_length = strlen($password); // Determine the maximum length of password. This is only needed if // the user enters a very long password. In any case, the salt will // be a maximum of half the end result. The longer the hash, the // longer the password/salt can be. $password_max_length = $hash_length / 2; // Shorten the salt based on the length of the password. if ($password_length >= $password_max_length) { $salt = substr($salt, 0, $password_max_length); } else { $salt = substr($salt, 0, $password_length); } // Determine the length of the salt. $salt_length = strlen($salt); // Determine the salted hashed password. $salted_password = hash($algorythm, $salt . $password); // If we add the salt to the hashed password, we would get a hash that // is longer than a normally hashed password. We don't want that; it // would give away hints to an attacker. Because the password and the // length of the password are known, we can just throw away the first // couple of characters of the salted password. That way the salt and // the salted password together are the same length as a normally // hashed password without salt. $used_chars = ($hash_length - $salt_length) * -1; $final_result = $salt . substr($salted_password, $used_chars); return $final_result; } ?> http://php.net/manual/en/function.sha1.php