note 56934 added to function.md5

It seems that the best solution would be to use HMAC-MD5. An implementation of HMAC-SHA1 was posted by mark on 30-Jan-2004 02:28 as a user comment to sha1() function (-> http://php.net/manual/function.sha1.php#39492). Here's how it would look like (some other optimizations/modifications are included as well): <?php // Calculate HMAC according to RFC2104 // http://www.ietf.org/rfc/rfc2104.txt function hmac($key, $data, $hash = 'md5', $blocksize = 64) { if (strlen($key)>$blocksize) { $key = pack('H*', $hash($key)); } $key = str_pad($key, $blocksize, chr(0)); $ipad = str_repeat(chr(0x36), $blocksize); $opad = str_repeat(chr(0x5c), $blocksize); return $hash(($key^$opad) . pack('H*', $hash(($key^$ipad) . $data))); } // Remember to initialize MT (using mt_srand() ) if required function pw_encode($password) { $seed = substr('00' . dechex(mt_rand()), -3) . substr('00' . dechex(mt_rand()), -3) . substr('0' . dechex(mt_rand()), -2); return hmac($seed, $password, 'md5', 64) . $seed; } function pw_check($password, $stored_value) { $seed = substr($stored_value, 32, 8); return hmac($seed, $password, 'md5', 64) . $seed==$stored_value; } // Test $password = 'foobar'; $encoded = pw_encode($password); $result = pw_check ($password, $encoded) ? 'true' : 'false'; echo<<<END password: $password encoded : $encoded rsult : $result END; ?> ---- Manual Page -- http://www.php.net/manual/en/function.md5.php Edit -- http://master.php.net/manage/user-notes.php?action=edit+56934 Delete: added to the manual -- http://master.php.net/manage/user-notes.php?action=delete+56934&report=yes&reason=added+to+the+manual Delete: bad code -- http://master.php.net/manage/user-notes.php?action=delete+56934&report=yes&reason=bad+code Delete: spam -- http://master.php.net/manage/user-notes.php?action=delete+56934&report=yes&reason=spam Delete: useless -- http://master.php.net/manage/user-notes.php?action=delete+56934&report=yes&reason=useless Delete: non-english -- http://master.php.net/manage/user-notes.php?action=delete+56934&report=yes&reason=non-english Delete: already in docs -- http://master.php.net/manage/user-notes.php?action=delete+56934&report=yes&reason=already+in+docs Delete: other reasons -- http://master.php.net/manage/user-notes.php?action=delete+56934&report=yes Reject -- http://master.php.net/manage/user-notes.php?action=reject+56934&report=yes Search -- http://master.php.net/manage/user-notes.php