note 58737 added to function.microtime

From: Date: Mon, 14 Nov 2005 15:18:28 +0000
Subject: note 58737 added to function.microtime
Groups: php.notes 
Request: Send a blank email to php-notes+get-98547@lists.php.net to get a copy of this message
Regarding discussion about generation of passwords using microtime. Its proberbly "ok" for a first-time password, but it is NOT better than random. Cryptographicly there will very limited keyspace to test of you use this method. If the stored password hash was to fall into wrong hands it would quite easily be cracked, as there are several factors that limits the combinations. Especially if you know ca. what time the password was issued. The string output from microtime looks like this: - 0.93839800 1131978543 The first number is always 0. On my computer, it seems that the 7th and 8th number are always "00", so lets assume that as well. In the last number (the epoch timestamp), there are only 3.600 combinations (=seconds) in an hour. That leaves 6 unpredictable digits (the 938398 above). thats 10^6 = 1.000.000 (combinations). 1.000.000 combinations can be checked in 55 seconds on my 3.2ghz So the time it takes to crack is 55 seconds, times the number of seconds youre guessing (in the timestamp).. If, say, you know ca. when the password was created, +-5minutes. That a 10 minute total, a span of 600 combinations, that would be: 600(seconds) * 55 (seconds crack time) = 9 hours. And that using just 1 computer.. ---- Manual Page -- http://www.php.net/manual/en/function.microtime.php Edit -- http://master.php.net/manage/user-notes.php?action=edit+58737 Delete: added to the manual -- http://master.php.net/manage/user-notes.php?action=delete+58737&report=yes&reason=added+to+the+manual Delete: bad code -- http://master.php.net/manage/user-notes.php?action=delete+58737&report=yes&reason=bad+code Delete: spam -- http://master.php.net/manage/user-notes.php?action=delete+58737&report=yes&reason=spam Delete: useless -- http://master.php.net/manage/user-notes.php?action=delete+58737&report=yes&reason=useless Delete: non-english -- http://master.php.net/manage/user-notes.php?action=delete+58737&report=yes&reason=non-english Delete: already in docs -- http://master.php.net/manage/user-notes.php?action=delete+58737&report=yes&reason=already+in+docs Delete: other reasons -- http://master.php.net/manage/user-notes.php?action=delete+58737&report=yes Reject -- http://master.php.net/manage/user-notes.php?action=reject+58737&report=yes Search -- http://master.php.net/manage/user-notes.php

« previous php.notes (#98547) next »