note 107899 added to faq.passwords

For those wishing to increase the computational cost of brute-forcing their password hashes by iterating the hash command multiple times, but don't want to increase the risk of a hash collision, simply re-append the password to the hash each iteration. <?php $iterations = 10; $hash = crypt($password,$salt); for ($i = 0; $i < $iterations; ++$i) { $hash = crypt($hash . $password,$salt); } ?> This, of course, can be used with md5(), sha1(), etc. as well as crypt(). Some other recommendations: - Use the highest number of iterations possible without introducing a significantly noticeable delay to authenticating users, or causing more CPU use than your host will allow. - Use a unique salt for each user, ideally a random one. - Use a salt of at least 24 bytes, especially if you're using a weaker algorithm like MD5 or SHA-1. ---- Server IP: 216.235.13.26 Probable Submitter: 208.97.108.26 ---- Manual Page -- http://www.php.net/manual/en/faq.passwords.php Edit -- https://master.php.net/note/edit/107899 Del: integrated -- https://master.php.net/note/delete/107899/integrated Del: useless -- https://master.php.net/note/delete/107899/useless Del: bad code -- https://master.php.net/note/delete/107899/bad+code Del: spam -- https://master.php.net/note/delete/107899/spam Del: non-english -- https://master.php.net/note/delete/107899/non-english Del: in docs -- https://master.php.net/note/delete/107899/in+docs Del: other reasons-- https://master.php.net/note/delete/107899 Reject -- https://master.php.net/note/reject/107899 Search -- https://master.php.net/manage/user-notes.php