Best encyption methods?

[OmniX]

I have tried to research this and im always running into old articles.

What I have come across are (possibly more):
md5, sha1, hash, crypt and mcrypt

Now I have used md5/sha1 before and have 32/40 character long strings the others I dont know too much about but in short, what is the best encryption method? (I may have not even listed it)

Thanks, Regards X

[cwarn23]

I just love this question. In my opinion, it is best to use more than one hash so that it is harder to crack. And so that those online database chrackers can't store your hash, include the whirlpool hash. So below is a function I have made for a much better hash:

function truehash($hashzzz) {
return hash('crc32b',hash('whirlpool',$hashzzz));
}

The function above will be really hard to crack as it uses oppisite types of output. One of the advantages with the function above is that crc32b is short (less data recorded) and whirlpool is long (containing more data). And since a whirlpool hash is 128 characters long, I doubt anybody will have a giant database of the whirlpool conversions. Of course you could use all of the hashes in the function but may make take a bit of cpu.
Any other comments?

[OmniX]

I havent researched the hash method in depth but what I have understood is that:

hash('$hash_string', $variable);

$hash_string = "abc" or whateva string you wish to use as hash method
$variable = variable wanting to hash (aka password)

So in your example you have doubled hashed your password, once using a long string and then against a short string? correct?

Due to the mix of the long and short encryption you believe this is the best method of encryptions?

The above correct? Thanks

[cwarn23]

Due to the mix of the long and short encryption you believe this is the best method of encryptions?

The above correct? Thanks

Yes that is correct.

[OmniX]

I forgot to ask, how many characters is the string produced?

Also am I correct in that I can use any string I wish to hash a password?

Thanks

[cwarn23]

The returned hash of my truehash function is 8 characters long and yes any string or number can be hashed through this function.

[OmniX]

I think I didnt ask my second question correctly.

The terms 'crc32b' and 'whirlpool' are just random variables selected or actual hash functions? could I have used 'apple123' and 'banana123' instead?

[nav33n]

Check this link.. http://www.hudzilla.org/phpbook/read.php/17_3_7
I also read here that md5 can generate collision (and is not safe anymore!). Someone also mentions (in the 2nd link) that whirlpool (as mentioned by cwarn23) is a good replacement! SHA1 isn't a safe encryption method too! :S Hmm.. I should stop using SHA1 !

[cwarn23]

I think I didnt ask my second question correctly.

The terms 'crc32b' and 'whirlpool' are just random variables selected or actual hash functions? could I have used 'apple123' and 'banana123' instead?

Well the terms 'crc32b' and 'whirlpool' are what tells the computer which type of hash to use, so no you can't change those unless you want to use a different type of hash. It is the second field contains the string to hash.

[nav33n]

I just love this question. In my opinion, it is best to use more than one hash so that it is harder to crack. And so that those online database chrackers can't store your hash, include the whirlpool hash. So below is a function I have made for a much better hash:

function truehash($hashzzz) {
return hash('crc32b',hash('whirlpool',$hashzzz));
}

The function above will be really hard to crack as it uses oppisite types of output. One of the advantages with the function above is that crc32b is short (less data recorded) and whirlpool is long (containing more data). And since a whirlpool hash is 128 characters long, I doubt anybody will have a giant database of the whirlpool conversions. Of course you could use all of the hashes in the function but may make take a bit of cpu. Any other comments?

Thats a very nice function. I wish I could give you more rep today :)

[OmniX]

nav33n my man! How you been!?!?!

Can we download the md5 anti hash method, so we can test our own web applciations?

Also how I assume to use the hash method is correct?

Thanks, REgards X

[nav33n]

I am good OmniX! How are you ?

I don't think there is any decrypting script/function which you can download. They have mentioned how there can be a collision between 2 different strings giving out the same hash ! I tried to read some more about the same, but, everything is going right over my head :(
http://www.mscs.dal.ca/~selinger/md5collision/
http://www.unixwiz.net/techtips/iguide-crypto-hashes.html

Thank you for creating this thread.. I can spend the rest of the evening reading these links ;)

[OmniX]

I have had no internet for months!

I have alot of catching up to do so join me :p

Ill do some more research and wait for a few more additional comments and come up with something.

But am I assuming how the hash method works, is correct?
(use any string to encrypt a variable to produce a unique 8 character string?)

[cwarn23]

I don't think there is any decrypting script/function which you can download. They have mentioned how there can be a collision between 2 different strings giving out the same hash ! I tried to read some more about the same, but, everything is going right over my head :(

Although there may be no dehasher on the market that doesn't stop you from making one. But it does require about 2 petabytes of hardrive space (2048TB or 2097152GB). I have created a dehasher that simply records every key combination and its hash into a mysql database then when dehashing, just simply do a reverse lookup by searching for the recorded hash and original word when the entry was generated. Just let me know if you would like the script.

[nav33n]

But am I assuming how the hash method works, is correct? (use any string to encrypt a variable to produce a unique 8 character string?)

Yep. Thats correct. In this case, the algorithm convert it to 8 character string.

[nav33n]

Although there may be no dehasher on the market that doesn't stop you from making one. But it does require about 2 petabytes of hardrive space (2048TB or 2097152GB). I have created a dehasher that simply records every key combination and its hash into a mysql database then when dehashing, just simply do a reverse lookup by searching for the recorded hash and original word when the entry was generated. Just let me know if you would like the script.

Woah ! Something like a keylogger ? Is it in php or java/vb.net ?

[cwarn23]

Woah ! Something like a keylogger ? Is it in php or java/vb.net ?

It is php and to dehash sha1 you can simply use the following scripts (page titles are on second line of each code box):

<?
//db.php
//configure below mysql variables
$dbhost='localhost';
$accountname='root';
$password='';
$database='my database';
?>

Above box will configure the database. The database needs a table with the name 'dehasher' and two columns each named 'word' and 'hash'. Also the above must be named db.php
Below is the search page (index.php)

<?
//index.php
if (isset($_GET['hash']))
	{
	set_time_limit(0);
	ini_set('memory_limit','512M');
	ini_set('mysql.cache_size','1073741824');
	include('db.php');
	mysql_connect($dbhost,$accountname,$password)
	or die("Could not connect to MySQL server");
	mysql_select_db($database) or die(mysql_error()."Could not select database");
	$rowid=0;
	$sqlresult=mysql_query("SELECT * FROM `dehasher`");
	while ($row = mysql_fetch_array($sqlresult))
		{
		if ($_GET['hash']==$row['hash'])
			{
			$word=$row['word'];
			$dehashed=1;
			break;
			}
		}
	mysql_free_result($sqlresult);
	unset($row);
	}
echo "Enter in the details below and click the dehash button to dehash the code.
<b>Please note it may take a few minutes to dehash due to the size of the database</b>
<table border=1 cellpadding=5 cellspacing=0 bgcolor=#FFCCCC><tr><td>
<form style='padding:0; margin:0;'>
<table border=0 cellpadding=0 cellspacing=0 bgcolor=#FFCCCC><tr><td>
Insert hash below</td><td>Hash type</td></tr><tr><td valign=top>
<input type='text' name='hash' size=50> </td><td align=left><input type='submit' value='dehash'>
</td></tr></table>
</form></td></tr></table>";
if (!isset($dehashed)) { $dehashed=0; }
if ($dehashed==1)
    {
    echo "<p>.<p><font size=3>The hash was decrypted successfully.Below are the details:
    <table border=1 cellpadding=0 cellspacing=0><tr><td>
    <table border=0 cellpadding=4 cellspacing=0><tr>
    <td bgcolor=#EEBBBB><font face='arial'><b>Word</b></font></td><td bgcolor=#FFCCCC>".$word."</td></tr><tr>
    <td bgcolor=#D8CCCC><font face='arial'><b>Hash</b></font></td><td bgcolor=#E9DDDD>".$_GET['hash']."</td></tr></table>
    </td></tr></table>";
    } else if (isset($_GET['hash'])) {
    echo "<b>Your hash could not be decrypted.</b>";
    }
?>

And below is the database generator:

<?
//generator.php
set_time_limit(0);
ini_set('memory_limit','2147483648M');
ini_set('mysql.cache_size','1073741824');
include('db.php');
mysql_connect($dbhost,$accountname,$password)
or die("Could not connect to MySQL server");
mysql_select_db($database) or die(mysql_error()."Could not select database");
$rownum=0;
//echo - text debugger for IE.
echo "<img src=0.gif width=1 height=1 alt='                                                       ".
"                                                                                             '>";
$list=" ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890`~!@#$%^&*()-_=+\|[{]};:\"',<.>/?abcdefghijklmnopqrstuvwxyz.,";
$loops=38430716820228233;
$chars=30;
$allwords=array();
$sqlresult=mysql_query("SELECT `word` FROM `dehasher`");
while ($row = mysql_fetch_array($sqlresult))
        {
        $allwords[]=$row['word'];
        }
mysql_free_result($sqlresult);
unset($row);
unset($sqlresult);
while (count($allwords)<$loops)
	{
	$escapecharplus=0;
	$repeat=mt_rand(1,$chars);
	while ($escapecharplus<$repeat)
		{
		$randomword.=$list[mt_rand(1, strlen($list)-1)];
		$escapecharplus+=1;
		}
	if (!in_array($randomword,$allwords))
		{
		$allwords[]=$randomword;
		$rowid+=1;
		mysql_query("INSERT INTO `dehasher` SET `word`='".mysql_real_escape_string($randomword).
                "', `hash`='".mysql_real_escape_string(hash('sha1', $randomword))."'");
		echo mysql_error();
		$rownum+=1;
		echo "<xmp>".$randomword."\n</xmp>";
                flush();
		unset($randomword);
                if (mt_rand(1,32)==2)
                        {
                        mysql_query("DELETE FROM `dehasher` WHERE `word`=''; DELETE FROM `dehasher` WHERE `hash`=''");
                        }
                usleep(50000); // lower cpu
                }
        }
?>

But as you can see, if you used a whirlpool hash it would take 4 times the amount of hardrive space than the average size hash assuming the average size hash is 32 characters. But have fun dehashing if you have plenty of harddrive space.

[nav33n]

Hmm.. one question though.. The table will store random strings and their hashes.. I guess it would be more efficient if a dictionary (like the ones used in Brute force) with all the commonly used words are also stored..

[OmniX]

So if your double hasing a password as such, why not just make it even harder and make it a triple hasher with 3 unique words like banana, apple and pear? and if not even harder with apricot, peach, grape and just make a like 10 x hash encrypter?

Im just trying to understand the functioning of the hash encrypter before I start on my encrypting!

Thanks, Regards X

[nav33n]

You can! But you will just be adding unnecessary overload to your CPU ! I think you can use cwarn23's function. Its neat !