note 107337 added to function.sha1

The hashSSHA function provided in the previous comment has poor salt generation. It only generates four bytes of salt (OpenLDAP generates eight) and uses rand(), which on some platforms can only end up generating 15 bytes of randomness--not to mention it's likely not of cryptographic quality. Use this instead: $salt = mcrypt_create_iv(8, MCRYPT_DEV_URANDOM); $hash = "{SSHA}" . base64_encode(sha1($password . $salt, true) . $salt); If mcrypt is not available, you could instead read eight bytes from /dev/urandom or similar. ---- Server IP: 203.211.135.122 Probable Submitter: 12.2.84.2 ---- Manual Page -- http://www.php.net/manual/en/function.sha1.php Edit -- https://master.php.net/note/edit/107337 Del: integrated -- https://master.php.net/note/delete/107337/integrated Del: useless -- https://master.php.net/note/delete/107337/useless Del: bad code -- https://master.php.net/note/delete/107337/bad+code Del: spam -- https://master.php.net/note/delete/107337/spam Del: non-english -- https://master.php.net/note/delete/107337/non-english Del: in docs -- https://master.php.net/note/delete/107337/in+docs Del: other reasons-- https://master.php.net/note/delete/107337 Reject -- https://master.php.net/note/reject/107337 Search -- https://master.php.net/manage/user-notes.php