note 6477 deleted from function.crypt by jimw
| From: | jimw@php.net | Date: | Sat, 03 Nov 2001 18:17:12 +0000 |
| Subject: | note 6477 deleted from function.crypt by jimw | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-20368@lists.php.net to get a copy of this message | ||
In response to dn (hall@cs.unt.edu)
<p>
There is no reason MD5 cannot be used as a hash function for password protection.
<p>
MD5, like all hash functions, is designed to minimise the possibility of collisions. A hash function
would not be very secure if it did not do this.
<p>
Quoting from the MD5 RFC (refer to http://www.normos.org/ietf/rfc/rfc1321.txt)
"It is conjectured that the difficulty of coming up with two messages having the same message
digest is on the order of 2^64 operations, and that the difficulty of coming up with any message
having a given message digest is on the order of 2^128 operations."
<p>
Those people recommending XOR to encrypt sensitive information should look at any security book
before doing such a silly thing.
<p>
And I agree that William Stalling's book is excellent :-)