PHP salt加密/解密密码

Question

I'm trying to make register and log in forms having salt encryption, and I'm not really familiar with it. So everything is working except that log in can't recognize password so I'm pretty sure it's encryption problem. These are lines for register:

$hash = hash('sha256', $password1);
function createSalt()
{
$text = md5(uniqid(rand(), true));
return substr($text, 0, 3);
}
$salt = createSalt();
$password = hash('sha256', $salt . $hash);

and these are for login:

$userData = mysql_fetch_array($result, MYSQL_ASSOC);
$hash = hash('sha256', $userData['salt'] . hash('sha256', $password) );
if($hash != $userData['password'])
{
echo "Incorrect password";
}

Can anybody point the problem. Thanks!

Answer 1

Actually your code should work as far as i can see, though it is very unsafe!

1. Problem: SHA256 is not appropriate to hash passwords, because it is ways too fast. Use a slow key-derivation function like BCrypt.
2. Problem: A three character salt with only letters is nearly no protection.

Maybe your database field is smaller than 64 characters, or you are comparing different passwords. In every case there is an easier and safer way to hash passwords, just use the new functions password_hash() and password_verify() . There exists also a compatibility pack for earlier PHP versions.

// Hash a new password for storing in the database.
// The function automatically generates a cryptographically safe salt.
$hashToStoreInDb = password_hash($password, PASSWORD_BCRYPT);

// Check if the hash of the entered login password, matches the stored hash.
// The salt and the cost factor will be extracted from $existingHashFromDb.
$isPasswordCorrect = password_verify($password, $existingHashFromDb);

Answer 2

There are quite a few things wrong with this. For starters: Are you storing the salt with the password? If not, then passwords become unverifiable.

Security considerations:

hash('sha256', ... is insufficient; consider bcrypt, scrypt, or pbkdf2

• https://github.com/DomBlack/php-scrypt
• http://us2.php.net/password_hash
• https://defuse.ca/php-pbkdf2.htm

$text = md5(uniqid(rand(), true)); Ever heard of openssl_random_pseudo_bytes() ?

(Also, you shouldn't seek to decrypt passwords, only verify them.)

If you're not familiar with these concepts, play it safe and use a tried and true library.