note 90294 deleted from function.sha1 by danbrown

Note Submitter: paul ---- Maybe want to swap time() for uniqid(rand(), true) this would offer improved security been thinking more about this, this the example below, falls down by giving a hint at password length if the salt hash is guessed from within the password, which is in itself a slim chance, maybe it would be better to place salt at biggining of password, yes they knew the salt then by looking at the salt pass hash, ut they still have no idea of where it was added when creating the password or how many times it was added. So you could either use the first example I posted, where salt is any of upto 20 choices but if worked out, the attacker could get pass length which unfolds the rest of the salt hash method, or you can give them the hash and let them guess how man times and where it was added using this example <?php function createHash($inText, $salt=NULL, $mode='sha1'){ // set where salt will appear in hash // $saltStart = (strlen($inText)/2)+1; // split the password by the number above // $splitPass = str_split($inText, $saltStart); // if no salt given create random one // if($salt == NULL) { $salt = hash($mode, uniqid(rand(), true)); } // add salt into the password and hash it // if(count($splitPass) < 2) { $outHash = hash($mode, $salt.$splitPass[0]); } else { $outHash = hash($mode, implode($salt, $splitPass)); } // put salt at front of hash // $saltHash = $salt.$outHash; return $saltHash; } ?> I have no real idea which is stronger really, they are both confusing me to hell now, my guess would be the example above would be better as it's quicker for them to get going but would be harder to crack. paul