note 103071 deleted from function.hash by danbrown

Note Submitter: N0 at non dot co dot il ---- I've created this bunch of functions to generate hash with automatic random salt. I'm not expert in Cryptography but I think this salt will make your password much more harder to decrypt. take into account that your final hash will be 8 to 18 character larger <?php /** * Calculates passwords hash adding salt. * @param string $password the password by which to calculate the size of the salt. * @param string $hash if set the function will try to validate the password to this hash. * @param string $algo the algorithm to use when hashing default is 'sha256'. * @return mixed calculated hash string is returned if hash is valid or was not set.<br/> * FALSE is returned if hash is set but not valid. */ function gen_hash($password,$hash = NULL,$algo='sha256'){ $salt_size = get_salt_size($password); $salt = gen_salt($salt_size,$hash); //generate the hash using the salt and the password $new_hash = hash($algo,$salt[0].$password.$salt[1]); //appending the salt parts unhashed at the begining and the end of the hash $new_hash = $salt[0].$new_hash.$salt[1]; if(!$hash) return $new_hash; //if $hash was set and valid returns the hash else returns false else if ($hash == $new_hash) return $new_hash; return FALSE; } /** * Calculates the salt. * @param array $salt_size containing two integer values as returned from the function {@link get_salt_size()}. * @param string $hash if set the salt is not calculated but striped from the hash. * @return array array containing two values for the left(0) and right(1) parts of the salt. */ function gen_salt(array $salt_size,$hash = NULL){ //if hash is present get salt from hash otherwise generate new salt if ($hash) { $salt[0] = substr($hash,0,$salt_size[0]); $salt[1] = substr($hash,-$salt_size[1]); return $salt; } else { $temp_salt = substr(sha1(uniqid(rand(), true)), 0, $salt_size[0] + $salt_size[1]); $salt[0] = substr($temp_salt,0,$salt_size[0]); $salt[1] = substr($temp_salt,-$salt_size[1]); return $salt; } } /** * Calculates the size of the salt.<br/> * By square root of the first two charecter ascii code sum. * salt is set to minimum 8 digits and can be maximum 18 digits (9 at each side) * @param string $password the password by which to calculate the size of the salt. * @return array array containing two integer values for the left(0) and right(1) parts of the salt. */ function get_salt_size($password){ //calculate square root of the sum of the first two charecters ascii vals $salt_length = sqrt(ord($password) + ord(substr($password,1,1))); //in case the number is integer make sure the sult is 8 charecters long // devided equaly left and right from the hash if (floor($salt_length) == $salt_length) { $salt_left = 4; $salt_right = 4; } // other wise use the first two digits from the leftover as the salt size else { $salt_left = floor (($salt_length - floor($salt_length)) * 10 ); $salt_right = floor (($salt_length * 10 - floor($salt_length * 10 )) * 10 ); // check that the total salt length is 8 charecters long and if not make // it so. if (($salt_left + $salt_right) < 8 ) $salt_left = 8 - $salt_right; } return array($salt_left , $salt_right); } /* sample use of the functions * getting password and hash from the url * this is just for test so no input validation or other security mesures */ $password =''; $new_hash = ''; if (isset($_GET['password'])){ if (isset($_GET['hash'])) $hash = $_GET['hash']; else $hash = NULL ; $password = $_GET['password']; $salt_size = get_salt_size($password); if ($new_hash = gen_hash($password,$hash)) echo 'Calculated Hash: ',$new_hash; else echo "hash is not valid!"; if ($hash && $new_hash) echo "<br/> hash is valid!"; echo '<br/>'; } echo '<form method="GET" action=""> password <input type="text" name="password" value="'.$password.'"/> <br/> hash <input type="text" name="hash" value="'.$new_hash.'"/> <br/> <input type="submit"/> </form>';