I am currently building an online system, it has come to the point to think about securing peoples passwords. How ever, for admin reasons I was wondering if it was possible to decode the encoded password, I believe this is not possible with md5 but hoping there is another method?
Any help would be geat, also any other information regarding safety, thanks.
Here is a good PHP5 class that uses the mcrypt library for two way encryption.
php Syntax ( Toggle Plain Text ) <?php class Encryption { static $cypher = 'blowfish' ; static $mode = 'cfb' ; static $key = '1a2s3d4f5g6h' ; public function encrypt ( $plaintext ) { $td = mcrypt_...
It can be changed to work with PHP 4. You just need to change the PHP 5 features to 4:
php Syntax ( Toggle Plain Text ) <?php class Encryption { var $cypher = 'blowfish' ; var $mode = 'cfb' ; var $key = '1a2s3d4f5g6h' ; function Encryption ( ) { // do nothing }...
You can do it at the database level as well if you want.
For INSERT
Help with Code Tags PHP Syntax ( Toggle Plain Text ) $aes_key = "EF77FHH7-E6G1-31y4-w2D7-G4gH8HWF20H1" ; $sql = "INSERT INTO user(username, pass) VALUES ('bob', AES_ENCRYPT('password', '$aes_key' ))" ; $aes_key = "EF77FHH7-E6G1-31y4-w2D7-G4gH8HWF20H1";
$sql = "INSERT INTO ...
Hey.
Be careful if you do this in a SQL query tho. Some MySQL servers use plain-text query logs, so while your passwords might be encrypted in the database itself, they would be stored in their original form in the logs.
See these two pages in the manual for details on that.
• • • • Originally Posted by ezb I am currently building an online system, it has come to the point to think about securing peoples passwords. How ever, for admin reasons I was wondering if it was possible to decode the encoded password, I believe this is not possible with md5 but hoping there is another method?
Any help would be geat, also any other...
@digital-ether
I agree with you 100%, although 100.000 iterations seem a bit excessive to me. (But that's just me :-P)
However, I got to ask why you specifically mention high memory usage?
I think she recommended high memory usage so that the effort needed to try to recreate/hack any of the passwords would be excessive and not worth it. But if you use up that much processing/memory, wouldn't you make it untenable to be used within a login/registering system? For even a reasonable amount of requests even.
• • • • Originally Posted by Atli Thanks. I did use an array at first, adding each hash as an element and them imploding it before creating the final hash. (Like you do in your code.) However, after testing that I found that this method uses double the amount of memory the string concatenation method uses. Makes sense when you think about it. Both the array and the string will have to exist in memory at the...
Thanks. • • • • You could optimize the string concatenation. I did use an array at first, adding each hash as an element and them imploding it before creating the final hash. (Like you do in your code.) However, after testing that I found that this method uses double the amount of memory the string concatenation method uses. Makes sense when you think about it. Both the array and the string will have to...
I think she recommended high memory usage so that the effort needed to try to recreate/hack any of the passwords would be excessive and not worth it. But if you use up that much processing/memory, wouldn't you make it untenable to be used within a login/registering system? For even a reasonable amount of requests even.
It can be changed to work with PHP 4. You just need to change the PHP 5 features to 4: php Syntax ( Toggle Plain Text ) <?php class Encryption { var $cypher = 'blowfish' ; var $mode = 'cfb' ; var $key = '1a2s3d4f5g6h' ; function Encryption ( ) { // do nothing } function encrypt ( $plaintext ) { $td =...
Thread profile page for "Password encoding/decoding - PHP" on http://www.daniweb.com.
This report page is a snippet summary view from a single thread "Password encoding/decoding - PHP", located on the Message Board at http://www.daniweb.com.
This thread profile page shows the thread statistics for: Total Authors, Total Thread Posts, and Thread Activity