note 92405 added to function.crypt
| From: | info at gameframe dot net | Date: | Thu, 23 Jul 2009 08:41:53 +0000 |
| Subject: | note 92405 added to function.crypt | ||
| Groups: | php.notes | ||
| Request: | Send a blank email to php-notes+get-158612@lists.php.net to get a copy of this message | ||
With example below you are able to do CRYPT_MD5 based mysql authentication.
I have successfully implemented this to my live site. $stored variable pretend hash stored in a
database. Same way $user_input pretend form where user supplies a password.
We reencrypt a user supplied password with the salt in hash stored in a database to compare will it
match. This method works exactly the same way than FreeBSD MD5 authentication with SSHD etc.
I think you all got the point. Since this is "One-Way" method it provides far more better
protection protection
for your passwords in case of abuse occurs where evil user is able to get your hashes.
FreeBSD MD5 is not vulnerable to rainbow or dictionary attack unlike the default md5() and it is way
much harder to brute as my benchmark charts shows for JtR tests: http://gameframe.net/en/images/S5000PSLSASR/x5450_benchmarks.png
<?php
$user_input = "test123";
$no_md5 = "You need to have CRYPT_MD5 support and compile your PHP with --with-mcrypt";
if (CRYPT_MD5 != 1 || CRYPT_SALT_LENGTH < 12) { die ("$no_md5"); }
$encrypted_password = crypt($user_input);
echo "$encrypted_password \n";
$stored = '$1$yfV3OHMs$5B0Hsatq/E/V6AQ9omSPR/';
$salt = substr($stored, 0, CRYPT_SALT_LENGTH);
$encrypted = crypt($user_input, $salt);
// echo "$encrypted_password $encrypted";
if ($encrypted == $stored) {
echo "Password verified! \n";
} else {
echo "Password failed! \n";
}
// Verify
$stored2 = "$encrypted_password";
$salt2 = substr($stored2, 0, CRYPT_SALT_LENGTH);
$encrypted2 = crypt($user_input, $salt2);
if ($encrypted2 == $stored2) {
echo "Password reverified! \n";
} else {
echo "Password refailed! \n";
}
?>
----
Server IP: 69.147.83.197
Probable Submitter: 91.153.54.243
----
Manual Page -- http://www.php.net/manual/en/function.crypt.php
Edit -- https://master.php.net/note/edit/92405
Del: integrated -- https://master.php.net/note/delete/92405/integrated
Del: useless -- https://master.php.net/note/delete/92405/useless
Del: bad code -- https://master.php.net/note/delete/92405/bad+code
Del: spam -- https://master.php.net/note/delete/92405/spam
Del: non-english -- https://master.php.net/note/delete/92405/non-english
Del: in docs -- https://master.php.net/note/delete/92405/in+docs
Del: other reasons-- https://master.php.net/note/delete/92405
Reject -- https://master.php.net/note/reject/92405
Search -- https://master.php.net/manage/user-notes.php
