note 81084 deleted from function.mt-rand by cmb
| From: | cmb@php.net | Date: | Sun, 19 Jan 2020 08:38:57 +0000 |
| Subject: | note 81084 deleted from function.mt-rand by cmb | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-213916@lists.php.net to get a copy of this message | ||
Note Submitter: William Leslie
----
Do not rely on the strength of any 'home-brewed' cryptographic algorithm, such as the one
posted by dmoree at coker dot edu. Algorithms such as MD5 and SHA-1 have been the subject of
intense academic research and have known security properties.
While it is true that MD5 and SHA-1 are generally no longer recommended for use in new
cryptosystems, there are newer algorithms such as SHA-256 that address the older algorithms'
weaknesses. These newer algorithms have not received quite as much scrutiny as their older
counterparts, but have still been studied much more carefully than your home-brewed algorithm, most
likely.
Dmoree at coker dot edu's concern about rainbow tables is best addressed by a properly applied
salting technique. Every bit of 'salt' added to a cryptographic hash effectively extends
the complexity of the password and thus the size of the rainbow table needed to crack it.
Furthermore, wisely chosen password strength policies can mitigate such attacks.