note 59241 deleted from function.md5 by joey
| From: | joey@php.net | Date: | Sun, 17 Jul 2011 08:45:02 +0000 |
| Subject: | note 59241 deleted from function.md5 by joey | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-181614@lists.php.net to get a copy of this message | ||
Note Submitter: karig at karig dot net
----
Scramble your hashes.
If you are worried about whether these hash functions are "good enough" for security and
are tempted to combine hash functions to try to increase security, but you know that combining
hashes might be counterproductive, then why not use md5() to get your hash string, then use a custom
scramble function to rearrange the digits in that hash string?
Use this scramble function whenever a user is logging in: Encrypt the password with md5(), then with
your scramble function, and compare the result with the pre-encrypted password stored on your server
for that user.
Here is an example (you might decide to scramble the digits in a different order):
<?php
function scramble($p) {
// Assumes that $p is going to be 32 characters long
$q = $p{13} . $p{30} . $p{5} . $p{17} . $p{23} . $p{0}
. $p{28} . $p{4} . $p{18} . $p{25} . $p{6} . $p{20}
. $p{14} . $p{9} . $p{31} . $p{11} . $p{24} . $p{29}
. $p{10} . $p{3} . $p{15} . $p{26} . $p{8} . $p{12}
. $p{21} . $p{27} . $p{1} . $p{16} . $p{22} . $p{7}
. $p{19} . $p{2};
return $q;
}
$p = $_POST['password'];
// If the password is blank or too short, do something here.
$p = scramble(md5($p));
// Now set $s = scrambled password stored on server.
// If $p == $s then we have a match.
?>
You could even make the scramble function more elaborate by repeating certain arbitrary characters
an arbitrary number of times, e.g., having scramble() insert $p(19) into $q three or four times,
thus producing a string longer than 32 characters.