| | |
Best encyption methods?
Please support our PHP advertiser: PostgreSQL or MySQL? Compare and contrast the two most popular open source databases
![]() |
Nice loop and good information!
Ok I think I have everything now to start my encryption, wait i mean hashing :p
Any helpful additional information would be much appreciated
Thankyou everyone for your helpful input, Regards X
PS: cwarn23 I now have a better understanding of your function and it looks great, thanks again.
Ok I think I have everything now to start my encryption, wait i mean hashing :p
Any helpful additional information would be much appreciated

Thankyou everyone for your helpful input, Regards X
PS: cwarn23 I now have a better understanding of your function and it looks great, thanks again.
Last edited by OmniX; Feb 26th, 2009 at 1:12 am.
"You never stop learning." - OmniX
•
•
•
•
Maybe we could have a competition of the most secure and fastest hash mechinism.
Ignorance is definitely not bliss!
*PM asking for help will be ignored*
*PM asking for help will be ignored*
•
•
Join Date: Jul 2008
Posts: 148
Reputation:
Solved Threads: 25
the thing with hashes, is that they SHOULD NOT be able to be reversed. If the intention was to reverse it then it would be encryption.
Generally when i read about weak hashes being cracked its because of a design flaw in the algorithm, which contains math way above my head. Or someone has created a lookup table of common dictionary words, which is where salting the hashed string comes into play because even common words and combinations are no longer common.
I'd also be curious to see some comparative benchmarks regarding hashing a string once using a randomly generated salt as i provided, where the cpu intensity will be in the salt generation vs using a static salt(s) and then double hashing the string or any of the other methods cwarn provided.
If someone posts their test code and results, i'd be happy to run them on a handful of drastically different servers and post those results as well.
Generally when i read about weak hashes being cracked its because of a design flaw in the algorithm, which contains math way above my head. Or someone has created a lookup table of common dictionary words, which is where salting the hashed string comes into play because even common words and combinations are no longer common.
I'd also be curious to see some comparative benchmarks regarding hashing a string once using a randomly generated salt as i provided, where the cpu intensity will be in the salt generation vs using a static salt(s) and then double hashing the string or any of the other methods cwarn provided.
If someone posts their test code and results, i'd be happy to run them on a handful of drastically different servers and post those results as well.
If you're question/problem is solved don't forget to mark the thread as Solved!
-- Code I post is usually but not always tested. If it is tested it will be against 5.2.11 or 5.3.0
-- Code I post is usually but not always tested. If it is tested it will be against 5.2.11 or 5.3.0
I have just done a quick test on some of the different types of hash methods used in the article and the script is as follows:
The above code outputs something simular to the following:
And it turns out that if you add a fixed salt before and after the script it will speed up the script. So below is an example of a faster version of my truehash() function
Don't know why it speeds up but it just does. Also, you can check the comparison of the various speeds with the various examples and looks like the least secure hash (IMO) that relied on a salt is the fastest. Also another way to make sure that the hash cannot be dehashed (as I call it) by those mainframe computers (1.7TB cpu - 2001 worlds fastest computer), you could just remove half the characters from the hash with the substr() function. I hear a new IBM computer that can handle 100,000,000,000,000,000 floating point operations per second (Also known as Peta-flops) is comming out in 2011. It probably won't need a database to crack a hash as it would have enough cpu to keep on doing random hashes untill it gets the right one. And that I am guessing would only take maybe an hour per group of hashes.
php Syntax (Toggle Plain Text)
<? function truehash_a($hashzzz) { return hash('crc32b',hash('whirlpool',$hashzzz)); } function salthash_a($hashzzz) { return hash('crc32b',hash('whirlpool','asdf'.$hashzzz.'jklh')); } function salthash_b($hashzzz) { return hash('crc32b',hash('whirlpool',hash('crc32b',$hashzzz).$hashzzz.'jklh')); } function salthash_c($hashzzz) { return hash('crc32b',hash('whirlpool',strlen($hashzzz).'18'.$hashzzz.'jklh')); } function salthash_d($hashzzz) { $varzzz=4*strlen($hashzzz); return hash('crc32b',hash('whirlpool','6'.$varzzz.'18'.$hashzzz.'jklh')); } function salthash_e($hashzzz) { $sPossible = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ!@#$%^&*()-+=[]{}|'; $iPossibleCount = strlen( $sPossible ); $sSalt = ''; for( $i=0; $i<$iLength; $i++ ) { $sSalt .= $sPossible[mt_rand(0, $iPossibleCount)]; } $sHash = hash('whirlpool', $hashzzz . $sSalt); } //======================= $time_start = microtime(true); truehash_a('absdefghijklmnopqrstuvwxyz'); $time_end = microtime(true); $time = $time_end - $time_start; $time=$time*1000; $time=preg_replace('/([0-9]+)\./','0.00$1',$time); echo "truehash_a() takes $time seconds to execute.<br>\n"; unset($time_start); unset($time_end); unset($time); //- - - - - - - - - - - - $time_start = microtime(true); salthash_a('absdefghijklmnopqrstuvwxyz'); $time_end = microtime(true); $time = $time_end - $time_start; $time=$time*1000; $time=preg_replace('/([0-9]+)\./','0.00$1',$time); echo "salthash_a() takes $time seconds to execute.<br>\n"; unset($time_start); unset($time_end); unset($time); //- - - - - - - - - - - - $time_start = microtime(true); salthash_b('absdefghijklmnopqrstuvwxyz'); $time_end = microtime(true); $time = $time_end - $time_start; $time=$time*1000; $time=preg_replace('/([0-9]+)\./','0.00$1',$time); echo "salthash_b() takes $time seconds to execute.<br>\n"; unset($time_start); unset($time_end); unset($time); //- - - - - - - - - - - - $time_start = microtime(true); salthash_c('absdefghijklmnopqrstuvwxyz'); $time_end = microtime(true); $time = $time_end - $time_start; $time=$time*1000; $time=preg_replace('/([0-9]+)\./','0.00$1',$time); echo "salthash_c() takes $time seconds to execute.<br>\n"; unset($time_start); unset($time_end); unset($time); //- - - - - - - - - - - - $time_start = microtime(true); salthash_d('absdefghijklmnopqrstuvwxyz'); $time_end = microtime(true); $time = $time_end - $time_start; $time=$time*1000; $time=preg_replace('/([0-9]+)\./','0.00$1',$time); echo "salthash_d() takes $time seconds to execute.<br>\n"; unset($time_start); unset($time_end); unset($time); //- - - - - - - - - - - - $time_start = microtime(true); salthash_e('absdefghijklmnopqrstuvwxyz'); $time_end = microtime(true); $time = $time_end - $time_start; $time=$time*1000; $time=preg_replace('/([0-9]+)\./','0.00$1',$time); echo "salthash_e() takes $time seconds to execute. (mschroeder's hasher)\n"; unset($time_start); unset($time_end); unset($time); ?>
PHP Syntax (Toggle Plain Text)
truehash_a() takes 0.0000791549682617 seconds to execute. salthash_a() takes 0.0000507831573486 seconds to execute. salthash_b() takes 0.0000548362731934 seconds to execute. salthash_c() takes 0.0000519752502441 seconds to execute. salthash_d() takes 0.0000441074371338 seconds to execute. salthash_e() takes 0.0000419616699219 seconds to execute. (mschroeder's hasher)
php Syntax (Toggle Plain Text)
function truehash($hashzzz) { return hash('crc32b',hash('whirlpool','asdf'.$hashzzz.'jklh')); } //the above function in the results is salthash_a()
Try not to bump 10 year old threads as it can be really annoying.
Like php then read my website at http://syntax.cwarn23.net/
Star-Trek-Atlantis - now that's what I call a movie ^_^
My favourite PC. - MacGyver Fan
Bad english note: dis-iz-2b4u
Like php then read my website at http://syntax.cwarn23.net/
Star-Trek-Atlantis - now that's what I call a movie ^_^
My favourite PC. - MacGyver Fan
Bad english note: dis-iz-2b4u
•
•
Join Date: Jul 2008
Posts: 148
Reputation:
Solved Threads: 25
just did a quick run of these on my local machine:
truehash_a() takes 0.00002598762512207 seconds to execute.
salthash_a() takes 0.000015020370483398 seconds to execute.
salthash_b() takes 0.000015974044799805 seconds to execute.
salthash_c() takes 0.000015974044799805 seconds to execute.
salthash_d() takes 0.000015974044799805 seconds to execute.
salthash_e() takes 0.00002598762512207 seconds to execute. (mschroeder's hasher)
**** These results are from php 5.3.0 the rest of the results will be from 5.2.8 installs
I did have to make one small change though:
the for loop wasn't getting a length to check against so i just hardcoded it to 10.
However I get the same results with the speedup when adding static salts. That is very unexpected. I'll post additional test results from other machines tomorrow.
truehash_a() takes 0.00002598762512207 seconds to execute.
salthash_a() takes 0.000015020370483398 seconds to execute.
salthash_b() takes 0.000015974044799805 seconds to execute.
salthash_c() takes 0.000015974044799805 seconds to execute.
salthash_d() takes 0.000015974044799805 seconds to execute.
salthash_e() takes 0.00002598762512207 seconds to execute. (mschroeder's hasher)
**** These results are from php 5.3.0 the rest of the results will be from 5.2.8 installs
I did have to make one small change though:
php Syntax (Toggle Plain Text)
function salthash_e($hashzzz) { $sPossible = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ!@#$%^&*()-+=[]{}|'; $iPossibleCount = strlen( $sPossible ); $sSalt = ''; for( $i=0; $i<10; $i++ ) { $sSalt .= $sPossible[mt_rand(0, $iPossibleCount)]; } $sHash = hash('whirlpool', $hashzzz . $sSalt); }
the for loop wasn't getting a length to check against so i just hardcoded it to 10.
However I get the same results with the speedup when adding static salts. That is very unexpected. I'll post additional test results from other machines tomorrow.
Last edited by mschroeder; Feb 26th, 2009 at 3:10 am.
If you're question/problem is solved don't forget to mark the thread as Solved!
-- Code I post is usually but not always tested. If it is tested it will be against 5.2.11 or 5.3.0
-- Code I post is usually but not always tested. If it is tested it will be against 5.2.11 or 5.3.0
Sounds good keep up the work!
But if they are getting quicker, the more hashing/variables you introduced - it dosent make quite sense?
But if they are getting quicker, the more hashing/variables you introduced - it dosent make quite sense?
"You never stop learning." - OmniX
•
•
•
•
But if they are getting quicker, the more hashing/variables you introduced - it dosent make quite sense?
php Syntax (Toggle Plain Text)
hash('whirlpool', 'asdf'.$hashzzz.'jklh'); //above will be faster than below hash('whirlpool', $hashzzz);
Try not to bump 10 year old threads as it can be really annoying.
Like php then read my website at http://syntax.cwarn23.net/
Star-Trek-Atlantis - now that's what I call a movie ^_^
My favourite PC. - MacGyver Fan
Bad english note: dis-iz-2b4u
Like php then read my website at http://syntax.cwarn23.net/
Star-Trek-Atlantis - now that's what I call a movie ^_^
My favourite PC. - MacGyver Fan
Bad english note: dis-iz-2b4u
1
#39 22 Days Ago
Sorry for resurrecting an old thread. But it was referenced recently and I thought I'd add to it.
crc32b should not be used with passwords as it is an insecure hash function.
http://en.wikipedia.org/wiki/Cyclic_redundancy_check
It also generates hashes that are only 8 hexadecimal (base 16) digits long. Thus you have less then 16^8 possible hashes. (or less then 10 digits decimal)
A simple brute force such as:
will produce a collision for any crc32b hash within an hour on an average PC. Using crc32b basically makes the original hashing function (whirlpool in this example) useless.
Whirlpool produces a 128 digit hexadecimal. Thus you should keep the whole hash in order to preserve its effectiveness against attacks. Rehashing a whirlpool hash with another hash that produces a shorter hash probably isn't a good idea. If you're doing it to save space, there are better alternatives.
http://www.bucabay.com/php/base-conv...php-radix-255/
You should also always salt passwords before hashing to make rainbow tables (and other precomputation attacks) unfeasible.
http://en.wikipedia.org/wiki/Rainbow_table
A rainbow table, is just a list of possible passwords, and their corresponding hashes. So it can be thought of as a simple database table with one column for the password, and the other for its hash. However, generating all the possible passwords for longer passwords, and more characters, requires a lot of space. So rainbow tables use a time-space trade off to save space. This however makes the generation of these tables computationally expensive. So if you salt a password, you effectively make it long enough that it would be infeasible to generate a rainbow table for it.
You should use a salt that makes precomputation attacks infeasible.
Currently rainbow tables with up to 14 characters length are common so more then 14 characters at minimum for a salt. There is no reason not to use a salt say 128 characters long with a password hashed with whirlpool.
Wordpress API generates some good salts: http://api.wordpress.org/secret-key/1.1/
Lastly, you need to make sure brute force is infeasible. A salt only works against precomputation attacks. With brute force, a known salt, does not hinder the attack at all.
Example:
For simplicity lets say only digits can be used for passwords:
Now, even though the password is salted before hashing, we still have the problem that we can't rely on hiding the salt, so we have to consider it known. We also can't rely on the password being more then 10 digits, since most people do not remember such long passwords.
Thus a simple brute force on a single machine will still crack the password within an hour or two.
The only difference between a password of just digits in this example, and one of actual characters is that characters have a larger base, but it doesn't really change much considering most passwords will be a smaller set of the 26 alphabetic characters.
There are a few ways to thwart this. One is key stretching.
http://en.wikipedia.org/wiki/Key_strengthening
This is to hash the password and seed over and over in order to make a brute force N times slower, where in is the number of repeated hashing.
eg:
This makes a brute force at least 1000 time slower.
What to note is that the slower your login is, the better. You can afford to wait a few milliseconds or seconds longer, but an attacker cannot.
The other solution is to use a computationally intensive hashing function such as bcrypt. http://www.usenix.org/events/usenix9...tml/node1.html
Sources:
http://chargen.matasano.com/chargen/...w-about-s.html
http://www.freerainbowtables.com/
http://www.codinghorror.com/blog/archives/000949.html
http://en.wikipedia.org/wiki/Cyclic_redundancy_check
http://en.wikipedia.org/wiki/Cryptog..._hash_function
crc32b should not be used with passwords as it is an insecure hash function.
http://en.wikipedia.org/wiki/Cyclic_redundancy_check
It also generates hashes that are only 8 hexadecimal (base 16) digits long. Thus you have less then 16^8 possible hashes. (or less then 10 digits decimal)
A simple brute force such as:
php Syntax (Toggle Plain Text)
$hash = hash('crc32b', hash('whirlpool', 'some password ^#d@C~')); while($hash != hash('crc32b', $n)) { $n++; } echo $n;
will produce a collision for any crc32b hash within an hour on an average PC. Using crc32b basically makes the original hashing function (whirlpool in this example) useless.
Whirlpool produces a 128 digit hexadecimal. Thus you should keep the whole hash in order to preserve its effectiveness against attacks. Rehashing a whirlpool hash with another hash that produces a shorter hash probably isn't a good idea. If you're doing it to save space, there are better alternatives.
http://www.bucabay.com/php/base-conv...php-radix-255/
You should also always salt passwords before hashing to make rainbow tables (and other precomputation attacks) unfeasible.
http://en.wikipedia.org/wiki/Rainbow_table
A rainbow table, is just a list of possible passwords, and their corresponding hashes. So it can be thought of as a simple database table with one column for the password, and the other for its hash. However, generating all the possible passwords for longer passwords, and more characters, requires a lot of space. So rainbow tables use a time-space trade off to save space. This however makes the generation of these tables computationally expensive. So if you salt a password, you effectively make it long enough that it would be infeasible to generate a rainbow table for it.
You should use a salt that makes precomputation attacks infeasible.
Currently rainbow tables with up to 14 characters length are common so more then 14 characters at minimum for a salt. There is no reason not to use a salt say 128 characters long with a password hashed with whirlpool.
Wordpress API generates some good salts: http://api.wordpress.org/secret-key/1.1/
Lastly, you need to make sure brute force is infeasible. A salt only works against precomputation attacks. With brute force, a known salt, does not hinder the attack at all.
Example:
For simplicity lets say only digits can be used for passwords:
php Syntax (Toggle Plain Text)
$password = '123456789'; $salt = 'some really long random salt'; $hash = hash('whirlpool', $password.$salt );
Now, even though the password is salted before hashing, we still have the problem that we can't rely on hiding the salt, so we have to consider it known. We also can't rely on the password being more then 10 digits, since most people do not remember such long passwords.
Thus a simple brute force on a single machine will still crack the password within an hour or two.
php Syntax (Toggle Plain Text)
$salt = 'some really long random salt'; while($hash != hash('whirlpool', $n.$salt )) { $n++; }
The only difference between a password of just digits in this example, and one of actual characters is that characters have a larger base, but it doesn't really change much considering most passwords will be a smaller set of the 26 alphabetic characters.
There are a few ways to thwart this. One is key stretching.
http://en.wikipedia.org/wiki/Key_strengthening
This is to hash the password and seed over and over in order to make a brute force N times slower, where in is the number of repeated hashing.
eg:
php Syntax (Toggle Plain Text)
$password = '123456789'; $salt = 'some really long random salt'; $i = 1000; while($i--) { $password = hash('whirlpool', $password.$salt ); } $hash = $password;
This makes a brute force at least 1000 time slower.
What to note is that the slower your login is, the better. You can afford to wait a few milliseconds or seconds longer, but an attacker cannot.
The other solution is to use a computationally intensive hashing function such as bcrypt. http://www.usenix.org/events/usenix9...tml/node1.html
Sources:
http://chargen.matasano.com/chargen/...w-about-s.html
http://www.freerainbowtables.com/
http://www.codinghorror.com/blog/archives/000949.html
http://en.wikipedia.org/wiki/Cyclic_redundancy_check
http://en.wikipedia.org/wiki/Cryptog..._hash_function
www.fijiwebdesign.com - web design and development and fun
Cpanel Email - Let users Register email accounts on your website upon registration
Ajax Chat - Fully browser based chat!
Cpanel Email - Let users Register email accounts on your website upon registration
Ajax Chat - Fully browser based chat!
0
#40 22 Days Ago
•
•
•
•
code will produce a collision for any crc32b hash within an hour on an average PC.
php Syntax (Toggle Plain Text)
<?php function hash_string($string,$extrachars='',$mixsault=true) { $str=array(); if (strlen($string)>3) { $len=floor(strlen($string)/2); if ($mixsault==false) { $long=str_split(substr($string,0,$len).$extrachars.substr($string,$len),1); } else { $string=substr($string,0,$len).$extrachars.substr($string,$len); $long=str_split($string,1); } } else { $long=str_split($string.$extrachars,1); } for ($i=0;isset($long[$i]);$i++) { if (!isset($charconvert[$long[$i]])) { $charconvert[$long[$i]]=true; } } if ($mixsault==false) { ksort($charconvert); } $i=2; foreach ($charconvert AS $key=>$val) { $charconvert[$key]=$i++; } $amount=count($charconvert); unset($long); $arr=str_split($string,2); while (!empty($arr[0]) || $arr[0]===0) { for ($i=0;isset($arr[$i]);$i++) { $char=str_split($arr[$i],1); $arr[$i]=''; if (empty($charconvert[$char[1]])) { $tmp=1; } else { $tmp=$charconvert[$char[1]]; } $v=(($charconvert[$char[0]]*$tmp)+32+($amount-$tmp)); if ($v<256) { $str[]=chr($v); } else { $str[]=$char[0]; $arr[$i]=$char[1]; $arr=implode('',$arr); unset($arr); $arr=str_split($arr,2); unset($arrs); } unset($v,$tmp); } } unset($arr,$char,$charconvert); return implode('',$str); } echo hash_string('This is to be hashed','this is like a sault',false); //outputs: >–7FÊ3:JŽR echo hash_string('This is to be hashed','this is like a sault',false); //outputs: >–7FÊ3:JŽR echo hash_string('This is to be hashed','this is like a sault',true); //outputs: 1=BF^@=BFN‘jG½ftjF:Ä echo hash_string('This is to be hashed','this is like a sault',true); //outputs: 1=BF^@=BFN‘jG½ftjF:Ä echo hash_string('This is to be hashed'); //outputs: .:?C[XaA7— echo hash_string('This is to be hashed'); //outputs: .:?C[XaA7— echo hash_string('This is to be hashed','',false); //outputs: ;ƒ4?™07G{O echo hash_string('This is to be hashed','',false); //outputs: ;ƒ4?™07G{O ?>
Try not to bump 10 year old threads as it can be really annoying.
Like php then read my website at http://syntax.cwarn23.net/
Star-Trek-Atlantis - now that's what I call a movie ^_^
My favourite PC. - MacGyver Fan
Bad english note: dis-iz-2b4u
Like php then read my website at http://syntax.cwarn23.net/
Star-Trek-Atlantis - now that's what I call a movie ^_^
My favourite PC. - MacGyver Fan
Bad english note: dis-iz-2b4u
![]() |
Other Threads in the PHP Forum
- Previous Thread: Upcoming Events script (Free or Commercial)...?
- Next Thread: div tag + iframe
| Thread Tools | Search this Thread |
.htaccess alexa apache api array beginner beneath binary broadband broken cakephp checkbox class cms code convert cron curl database date display dynamic echo email encode error fcc file files folder form forms function functions google howtowriteathesis href htaccess html image images include insert ip javascript joomla key limit link login mail memberships menu mlm multiple multipletables mysql mysql_real_escape_string network oop open passwords paypal pdf php problem provider query radio random recursion redirect remote rss script search securephp server sessions sms smtp source space sql strip_tags syntax system table template tutorial update upload url user validator variable video voteup web youtube






