password security in PHP

Question

What method would you call safest and most secure? I took these snippets off php.net. I'm just wondering because people posted their own and I just couldn't catch on to understand why some are the way they are... Can someone help me out and tell me a little more about these? Which would be the most secure and why?

1.

<?php
$hash = md5($salt1.$password.$salt2);
?>

2.

<?php
function eliteEncrypt($string) {
    // Create a salt
    $salt = md5($string."%*4!#$;\.k~'(_@");

    // Hash the string
    $string = md5("$salt$string$salt");

    return $string;
}
?>

3.

<?php
define ('SALT_ONE', 'some_random_123_collection_&$^%_of_stuff');
define ('SALT_TWO', 'another_random_%*!_collection_ANbu_of_stuff');

$password = 'dragon';

function generate_encrypted_password($str) {
$new_pword = '';

if( defined('SALT_ONE') ):
   $new_pword .= md5(SALT_ONE);
endif;

$new_pword .= md5($str);

if( defined('SALT_TWO') ):
   $new_pword .= md5(SALT_TWO);
endif;

return substr($new_pword, strlen($str), 40);
}

echo generate_encrypted_password($password);
?>

4.

<?
function enchsetenev($toencode,$times)
{
    $salt = 's+(_a*';
    for($zo=0;$zo<$times;$zo=$zo+1)
    {
        $toencode = hash('sha512',salt.$toencode);
        $toencode = md5($toencode.$salt);
    }
    return $toencode;
}

?>

5.

<?php
$hash = $password . $salt;

for ( $i = 0; $i < 10000; $i++ ) {
  $hash = md5( $hash );
}

echo $hash;
?>

what about the for loops tho isn't it bad to encrypt a hash? — Kyle, Mar 08 '11 at 16:12
Personally, I prefer my salt to be unique for each user account, rather than using the same salt for every account. — Mark Baker, Mar 08 '11 at 16:17
The for ( $i = 0; $i < 10000; $i++ ) loop is wasteful, but at least the initial hashed value is salted... and remember boys and girls, a salt can include any 8-bit characters, rather than just being limited to keyboard characters. — Mark Baker, Mar 08 '11 at 16:19
All the things you suggest are insecure. Please see this answer: http://stackoverflow.com/a/401684/37386 — user9876, Mar 23 '13 at 01:27
You might want to check out *ALREADY ASKED* questions on SO: - http://stackoverflow.com/q/401656/158014 - http://stackoverflow.com/q/4388908/158014 - http://stackoverflow.com/q/2283937/158014 - http://stackoverflow.com/q/5089841/158014 Hope that helps. — Jakub, Mar 08 '11 at 16:16

score 5 · Accepted Answer · answered Mar 08 '11 at 16:19

It is a basic example of what we want, a salt added to the password
It is the same example but with the salt generation part.
A different method for salting, but still pretty equivalent
There's absolutely no point in this over complicated example, hashing with two different hash method many times absolutely don't improve security.
Like already said, there's absolutely no point to perform 10000 times a hash.

If you change the first example to :

<?php
  $hash = hash('sha256', $salt1.$password.$salt2);
?>

this will be secure enough for 99% of the application.

The only question is how to generate the salt. I recommend a fixed salt ($salt2) and on salt generated for each user ($salt1) which is stored in the database along the password.

This way you're pretty secure against rainbow table attack even if someone retrieves the content of your database.

Don't use SHA256 directly; it's far too easy to crack. Use a proper password hashing algorithm that was designed for this purpose (e.g. bcrypt, PBKDF2). And there's no such thing as "secure enough for 99% of the application" - many users will use the same password on your site and for their bank, so you need decent password hashing to protect that password. And there are libraries available, so doing it right isn't any harder than doing it badly. — user9876, Mar 23 '13 at 02:25

score 0 · Answer 2 · edited May 23 '17 at 11:45

0

A better option is to use something other than md5, check here for a previously answered question relating to this.

edited May 23 '17 at 11:45

Community

1
1

answered Mar 08 '11 at 16:14

FatherStorm

7,133
1
21
27

It's right but if you don't salt SHA1 is not better than md5, is your user uses a word found in a dictionary. – DNRN Mar 08 '11 at 16:15
@DNRN sha1 is way better than md5, it is actually really easy to found a collision for any md5 hash. – krtek Mar 08 '11 at 16:48
please note that the example question was answered with an explanatory link to and about salt... – FatherStorm Mar 08 '11 at 17:17

score 0 · Answer 3 · answered Mar 08 '11 at 16:16

there is no standard good answer for this. What I do know is that security and speed has to be balanced. You could AES encrypt every information but would that be feasible? To answer your question MD5 (which is one way encrypt) plus SALT (a really random string) is considered a good standard of security. It just happens to be fastest and secure enough.

If you try to implement your own encryption and what not it will be like that magic trick where you entangle the wire too many times and yet it comes undone with wrist slap. So go for SALT+MD5 unless you want to theorize and thesis-fy the idea.

score 0 · Answer 4 · answered Mar 08 '11 at 16:18

<?php
$hash = md5($salt1.$password.$salt2);
?>

This one I think suits most of the purpose so I will explain it . Reason there are two salt are because lets say $salt1 is unique to every username hence its an column in the user table (a random string generated when user registers), $salt2 is stored on filesystem somewhere in config.ini file which was created when the application was installed and its same for all users . Now to guess the password hacker will need $salt1 and $salt1 , he can have access to salt1 through sql injection , but not have access to filesystem where salt2 is sotred inside config.ini hence double protection .

md5 isn't secure anymore, collisions can be found in less than a day on any modern computer. Sure not everyone can do that, but you should recommend using at least `sha1`. — krtek, Mar 08 '11 at 16:46

score -1 · Answer 5 · answered Mar 08 '11 at 16:14

-1

Is it just 5 different ways to do almost the same? I think the learning objective here is to understand the importance of salting passwords. The best way to salt is to use as much salt as possible and the salt string includes as many crazy characters as possible.

answered Mar 08 '11 at 16:14

DNRN

2,397
4
30
48

since you're hashing the password and the salt anyway, the length and "crazy" factor of the salt aren't that relevant. Only important thing is to have a different salt for every password. – krtek Mar 08 '11 at 16:47

password security in PHP

5 Answers5

Linked