note 94176 deleted from function.crypt by joey

Note Submitter: Chris ---- I didn't like how crypt "formatted" the salt string, that reduces the randomness of the salt and gives an attacker clues as to what's going on. It easy to "roll your own" crypt with the function below. The resultant hash only contains hex digits, making it easy to store, pass on the URL, etc without giving any clues about what it is or how it was generated. <?php function mycrypt($clear, $hashed = NULL) { $salt_len = 100; if (empty($hashed)) for($salt = '', $x = 0; $x++ < $salt_len; $salt .= bin2hex(chr(mt_rand(0,255)))); // make a new salt else $salt = substr($hashed, 0, $salt_len*2); // extract existing salt return $salt . hash('whirlpool', $salt . $clear); } ?> You can adjust the salt length and hash algorithm as you desire - whirlpool is a pretty good hash and much more secure than crypt()'s MD5. Using/adding uniq(), microtime(), ip address, uuid, etc to the salt only weakens security by reducing it's randmoness. If you think your OS can provide better random numbers, use that instead of mt_rand().