note 107144 added to function.sha1

The previous SSHA example has very poor salt generation. rand() is not suitable for cryptographic use, only four bytes are used, and the sha1() call halves the effective bits that four bytes could otherwise represent. If you have the mcrypt extension, use this instead: $salt = mcrypt_create_iv(8, MCRYPT_DEV_URANDOM); $hash = "{SSHA}" . base64_encode(sha1($password . $salt, true) . $salt); If not, you could use fopen/fread to read eight bytes from the /dev/*random device of your choice and use that for the salt. ---- Server IP: 69.147.83.197 Probable Submitter: 12.2.84.2 ---- Manual Page -- http://www.php.net/manual/en/function.sha1.php Edit -- https://master.php.net/note/edit/107144 Del: integrated -- https://master.php.net/note/delete/107144/integrated Del: useless -- https://master.php.net/note/delete/107144/useless Del: bad code -- https://master.php.net/note/delete/107144/bad+code Del: spam -- https://master.php.net/note/delete/107144/spam Del: non-english -- https://master.php.net/note/delete/107144/non-english Del: in docs -- https://master.php.net/note/delete/107144/in+docs Del: other reasons-- https://master.php.net/note/delete/107144 Reject -- https://master.php.net/note/reject/107144 Search -- https://master.php.net/manage/user-notes.php