简体   繁体   中英

How can I make this more secure?

I am making a login system in PHP and I was wondering if this current hash function I have is secure enough.

public function genHash( $user, $pass )
{
    $user = strtoupper($user);
    $staticSalt  = $this->staticSalt;
    $dynamicSalt = hash('SHA512', md5($user . $pass) . sha1($pass) . hash('SHA512', $user . $pass));
    $final       = hash('WHIRLPOOL', $pass . $dynamicSalt . $staticSalt);
    return $final;
}

The static salt is just a bunch of random characters. Anyway, how can I make it more secure?

You could use different salts for each user and store them in the database but besides that this system looks pretty secure. (Not knowing the details of the server).

EDIT:

Theoretically multihashing a string increases the chance of hash collisions but I haven't found anything reliable that says this is a practical risk.

The technical post webpages of this site follow the CC BY-SA 4.0 protocol. If you need to reprint, please indicate the site URL or the original address.Any question please contact:yoyou2525@163.com.

 
粤ICP备18138465号  © 2020-2024 STACKOOM.COM