简体   繁体   中英

What info can be extracted from my password hashing function? Is it reversible?

With the following switch case method

switch ($crypt_type) {
      case "MD5": $crypted_pass = md5($password); break;
      case "SHA1": $crypted_pass = sha1($password); break;

      case "DESMD5":
//jpap
//      $salt = substr($crypt_type, 0, 11);
        $salt = substr($p_password, 0, 11);
//jpap
        $crypted_pass = crypt($password, $salt);
        break;

      case "CRYPT":
//jpap
//      $salt = substr($crypt_type, 0, 2);
        $salt = substr($p_password, 0, 2);
//jpap
        $crypted_pass = crypt($password, $salt);
        break;

      default: 
        $crypted_pass = sha1($password); break;
    }

this is the hashed password it was produced

$1$lwnY.pgz$rm4Bwn0XmK7k4QawHi8Cz0

What info can be extracted by this? Is it safe?

Hash function cannot be reversed which is why they are ideal for storing password. For explanation why is that so, check out this SO Question how-come-md5-hash-values-are-not-reversible and see the accepted answer

The original password cannot be extracted from this, that's by definition. From the provided string, I can deduct that $CRYPT_TYPE is crypt and the used algorithm is md5 with salt 1wnY.pgz . You should not use a part of the password as salt for crypt as this is visible in the result.

It is safe in the sense that the original value cannot be calculated from the hash.

The technical post webpages of this site follow the CC BY-SA 4.0 protocol. If you need to reprint, please indicate the site URL or the original address.Any question please contact:yoyou2525@163.com.

 
粤ICP备18138465号  © 2020-2024 STACKOOM.COM