note 108708 deleted from function.crypt by danbrown

Note Submitter: Anonymous ---- In response to sc1n at yahoo dot com: Your statement that crypt is "a relic of old style Unix password authentication and does weird stuff like prepend the salt to the hash" and that "If you are looking to hash passwords so users can login to a web interface, you probably want the function hash() function" is quite simply incorrect. Crypt, used properly (eg with sha256 or 512) represents probably the most secure method of hashing a password for storing in a database or similar and subsequently using to validate user logins. Crypt performs a multi-round hashing process on the input where as hash performs a single itteration of the hash making it much more susceptible to brute force. Remember, hashs are often used for validating the integrity of data, so they have to run fairly fast. Fast algorithms are much cheaper to brute force. For example, if hash runs in 0.001 seconds and crypt runs in 0.1 seconds, your logging in user won't notice; however brute forcing the password hashed using crypt will take 100 times as long. The fact that the salt and hash method is appended to the string makes it much easier to store (1 single db field) and allows you to change the hashing method of your application in response to security threats without having to invalidate your existing user passwords.