note 93676 deleted from function.md5 by joey

Note Submitter: netom at elte dot hu ---- Salt isn't just preventig hash-value pair reuse. Salt is for preventig rainbow table attacks. Rainbow tables are only useful for short passwords (6-8-10 characters, or so). If you salt your passwords, you increase the length of the hashed string dramatically, so they will not match anything in the rainbow table. The fact, that 8 character length passwords can be bruteforced with a PC is not the fault of the MD5 algorithm. sha1, or whatever hashes can be broken in a same way (brute force). The problem is that these hashes a "too fast". They can ben done billions of times per second. To prevent (slow down) brute force attacks, one can construct a hash function that is very hard to compute. This can be done easily: <?php $hash = $password . $salt; for ( $i = 0; $i < 10000; $i++ ) { $hash = md5( $hash ); } //Store your $hash ?> This is an implementation of the PBKDF2 function wich is described in the PKCS #5 v2 document.