note 108704 modified in function.crypt by danbrown
| From: | danbrown@php.net | Date: | Sat, 19 May 2012 00:48:59 +0000 |
| Subject: | note 108704 modified in function.crypt by danbrown | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-188066@lists.php.net to get a copy of this message | ||
Password hashing should be done only with crypt and NEVER with SHA* and MD5 or hash(). The
fundamental reason is that crypt is designed to be SLOW which is a VERY good thing for password
hashing. It also automatically generate a salt every time which
makes pre-computed tables to "decrypt" passwords useless (the generated salt is
stored in the returned string for convenience).
--was--
Password hashing should be done only with crypt and NEVER with SHA* and MD5 or hash(). The
fundamental reason is that crypt is designed to be SLOW which is a VERY good thing for password
hashing.
It also automatically generate a salt every time which makes pre-computed tables to
"decrypt" passwords useless (the generated salt is stored in the returned string for
convenience).
If you want to understand why please have a look at:
http://chargen.matasano.com/chargen/2007/9/7/enough-with-the-rainbow-tables-what-you-need-to-know-about-s.html
http://php.net/manual/en/function.crypt.php