note 92405 deleted from function.crypt by danbrown
| From: | danbrown@php.net | Date: | Thu, 23 Jul 2009 14:12:30 +0000 |
| Subject: | note 92405 deleted from function.crypt by danbrown | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-158630@lists.php.net to get a copy of this message | ||
Note Submitter: info at gameframe dot net
----
With example below you are able to do CRYPT_MD5 based mysql authentication.
I have successfully implemented this to my live site. $stored variable pretend hash stored in a
database. Same way $user_input pretend form where user supplies a password.
We reencrypt a user supplied password with the salt in hash stored in a database to compare will it
match. This method works exactly the same way than FreeBSD MD5 authentication with SSHD etc.
I think you all got the point. Since this is "One-Way" method it provides far more better
protection protection
for your passwords in case of abuse occurs where evil user is able to get your hashes.
FreeBSD MD5 is not vulnerable to rainbow or dictionary attack unlike the default md5() and it is way
much harder to brute as my benchmark charts shows for JtR tests: http://gameframe.net/en/images/S5000PSLSASR/x5450_benchmarks.png
<?php
$user_input = "test123";
$no_md5 = "You need to have CRYPT_MD5 support and compile your PHP with --with-mcrypt";
if (CRYPT_MD5 != 1 || CRYPT_SALT_LENGTH < 12) { die ("$no_md5"); }
$encrypted_password = crypt($user_input);
echo "$encrypted_password \n";
$stored = '$1$yfV3OHMs$5B0Hsatq/E/V6AQ9omSPR/';
$salt = substr($stored, 0, CRYPT_SALT_LENGTH);
$encrypted = crypt($user_input, $salt);
// echo "$encrypted_password $encrypted";
if ($encrypted == $stored) {
echo "Password verified! \n";
} else {
echo "Password failed! \n";
}
// Verify
$stored2 = "$encrypted_password";
$salt2 = substr($stored2, 0, CRYPT_SALT_LENGTH);
$encrypted2 = crypt($user_input, $salt2);
if ($encrypted2 == $stored2) {
echo "Password reverified! \n";
} else {
echo "Password refailed! \n";
}
?>
