| Newsgroups |
php.notes |
| Message-ID |
<[email protected]> |
This is partly in response to postfix at bk dot ru, concerning rainbow tables and the security of md5 as a password hash.
The idea behind rainbow tables is to, over time, create a database that contains all the possible md5 hashes. They don't need to contain every possible *password* because if they find a 3 letter word that produces the same hash (known as a "collision") as your 46 digit, alpha-numeric password that includes english, russian, and japanese characters... they can just use the 3 digit one instead. Now I'm not certain, but I think that with regular md5 hashes (unsalted) there is already a complete rainbow table in existence. This is why salts are useful.
Adding a salt to the password before hashing it forces attackers to create a brand new rainbow table, because the existing ones are useless. And if you go a step further with a script that uses a different salt for each user, they can only crack one password at a time.
And speaking of time... that is another important factor. The quicker a computer is able to hash a password, the more passwords it can try per second. A simple md5, for instance, can be calculated several hundred times per second on an average server. If, however, your script hashes the password 2,000 times, it will take a brute force attack at least 5 seconds per password (which means it would take roughly 33,109 years to run every 8 digit password using only lower case letters).
So... straight md5 = practically plain-text to a determined attacker.
Unique salts, and more server intensive hashes = a long life of boredom to a determined attacker.
----
Server IP: 64.71.164.2
Probable Submitter: 75.173.199.89
----
Manual Page -- http://www.php.net/manual/en/function.md5.php
Edit -- https://master.php.net/note/edit/86067
Del: integrated -- https://master.php.net/note/delete/86067/integrated
Del: useless -- https://master.php.net/note/delete/86067/useless
Del: bad code -- https://master.php.net/note/delete/86067/bad+code
Del: spam -- https://master.php.net/note/delete/86067/spam
Del: non-english -- https://master.php.net/note/delete/86067/non-english
Del: in docs -- https://master.php.net/note/delete/86067/in+docs
Del: other reasons-- https://master.php.net/note/delete/86067
Reject -- https://master.php.net/note/reject/86067
Search -- https://master.php.net/manage/user-notes.php