DooPHP IRC channel


Simple Password Hashing

Share your tips, snippets and experiences about DooPHP, and discuss about best DooPHP practices.

Simple Password Hashing

Postby tripbr » Sun Dec 26, 2010 9:47 pm

Hello guyz!

This is the little code that I made for hashing passwords for store in db.
Code: Select all
<?php

class PasswordHash {

    //Edit this salt value whit your own random salt
    private static $salt = 'IAS(2801idji1dj-3idhJOHCJUH#&DF!)*@_DOIJKDJAEKDJFO';

    public static function hash($password, $iterates = 10, $method = 'sha512', $compress = true, $compressMethod = 'md5') {
        if ($compress) {
            return hash($compressMethod, self::blow($password, $iterates, $method));
        } else {
            return self::blow($password, $iterates, $method);
        }
    }

    public static function check($password, $hash, $method = 'sha512', $iterates = 10, $compress = true, $compressMethod = 'md5') {
        if($compress){
            if(hash($compressMethod, self::blow($password, $iterates, $method)) != $hash){
                return false;
            }
        } else {
            if(self::blow($password, $iterates, $method) != $hash){
                return false;
            }
        }
    }

    protected static function blow($password, $iterates, $method) {
        for ($i = 0; $i <= $iterates; $i++) {
            $output = hash($method, isset($output) ? $password . self::$salt . $output : $password . self::$salt);
        }
        return $output;
    }

}


You can save this code on your class folder. Now you can use the code:
Code: Select all
Doo::loadClass('PasswordHash');
$hash = PasswordHash::hash('some_password');
//Now is safe to store $hash in you db

if(!PasswordHash::check('some_passoword', 'db_stored_hash')){
          echo 'You have entered the wrong password!';
}


That's it!
Hope you guyz like this little code!
Last edited by tripbr on Mon Dec 27, 2010 1:02 pm, edited 2 times in total.
Let's Doo::it
tripbr
 
Posts: 59
Joined: Thu Jun 24, 2010 2:21 pm

Re: Simple Password Hashing

Postby RichardM » Mon Dec 27, 2010 3:00 am

Hi,

Just a couple of thoughts/notes. Hope you don't mind

1) why is the class extending DooController? Classes in class/ should not really extend DooController as extensions of DooController should be for actual controllers within your app(s). Also I do not think you use any of the actual DooController methods simply use
Code: Select all
class PasswordHash {


2) those usinging this class should enter there own random salt and not just copy and pastenthe example salt provided.


Richard
Note: code samples my not be 100% accurate.
RichardM
 
Posts: 1329
Joined: Sun Aug 30, 2009 6:03 pm
Location: Cumbria, UK

Re: Simple Password Hashing

Postby tripbr » Mon Dec 27, 2010 1:05 pm

Hey Richard! You are right!
I had made some changes to the post.

I think that whit the actual process power, it's impossible to break this hash and get the password...
Let's Doo::it
tripbr
 
Posts: 59
Joined: Thu Jun 24, 2010 2:21 pm

Re: Simple Password Hashing

Postby vcardins » Mon Jan 24, 2011 3:38 pm

Hi Tripbr,

I avoid submitting passwords as plain text so I encrypt it using MD5 with Javascript and the process on the server side.
I'm not really sure what is the best security practice on this, so could you please share your thoughts ?
vcardins
 
Posts: 11
Joined: Wed Aug 25, 2010 3:13 pm

Re: Simple Password Hashing

Postby RichardM » Mon Jan 24, 2011 3:57 pm

vcardins wrote:I avoid submitting passwords as plain text so I encrypt it using MD5 with Javascript and the process on the server side.


Does this not beat the point? If you send the hash key in plain text someone only need send this back in clear text to your app? In other words the hash is the same as the password?

You would be better off using SSL to send the password over the internet to keep things secure.


Richard
Note: code samples my not be 100% accurate.
RichardM
 
Posts: 1329
Joined: Sun Aug 30, 2009 6:03 pm
Location: Cumbria, UK

Re: Simple Password Hashing

Postby roman » Mon Apr 25, 2011 5:42 pm

A solution offered at http://phpsec.org/articles/2005/password-hashing.html seems better.
roman
 
Posts: 442
Joined: Sat Aug 01, 2009 8:31 pm

Re: Simple Password Hashing

Postby RichardM » Mon Apr 25, 2011 7:04 pm

Hmm...I might be missing something here but I think the issue in question is sending the password between the end user and your server as basic authentication sends this in clear text over the internet. The methods in the page you have sent I think relate to the storage of the passwords on the server. The password would still be sent in clear text.

A salt value is used in some of the functions of DooPHP already


Richard
Note: code samples my not be 100% accurate.
RichardM
 
Posts: 1329
Joined: Sun Aug 30, 2009 6:03 pm
Location: Cumbria, UK

Re: Simple Password Hashing

Postby roman » Tue Apr 26, 2011 4:11 pm

I was replying to the original poster in this thread. He is not the one who suggested sending a hash from the browser to the server.
roman
 
Posts: 442
Joined: Sat Aug 01, 2009 8:31 pm


Return to Tips & Tricks

Who is online

Users browsing this forum: No registered users and 0 guests