PHP Password - Salted, reversed, encrypted

Question

I'd just like to know if this script is secure enough for a password encryption:

<?php

$password    = 'password';
$salt        = '9awd8n12jok1llawawf';

$new         = hash($password . $salt, 'ripemd160');
final        = strrev($new);

?>

Thanks.

What password encryption? how valuable are the passwords? Are you handling finance? — Benjamin Gruenbaum, Jul 04 '12 at 21:04
Why reverse it? This is completely unnecessary and adds nothing to security. — , Jul 04 '12 at 21:04
No. Please read this: http://stackoverflow.com/questions/1645161/salt-generation-and-open-source-software/1645190#1645190. — Oliver Charlesworth, Jul 04 '12 at 21:05
One script can't be secure. An procedure or a system might be secure. — madfriend, Jul 04 '12 at 21:06
NO! PLEASE don't do this! Go and learn how to use bcrypt at the very least! — Aaron Klotz, Jul 04 '12 at 21:07
This question sounds like a prime candidate for [CodeReview.SE](http://codereview.stackexchange.com/). — Wiseguy, Jul 04 '12 at 21:08
That's not the correct usage of [`hash()`](http://php.net/manual/en/function.hash.php) by the way. — sachleen, Jul 04 '12 at 21:08

score 3 · Accepted Answer · answered Jul 04 '12 at 21:05

3

Don't use the same salt for every password. Normally what you'll want to do is use some replicable value as the salt. For example, some hash of the user id (if the user id never changes), or some random string that you save with the user account information. The salt should never be visible to the end user.

answered Jul 04 '12 at 21:05

King Skippus

3,801
1
24
24

Just to be clear, it's not a heinous security violation if the salt is visible to the end user. It might make cracking the user's password a little easier, but as long as you're not revealing *all* salts to users, it shouldn't be a big deal. But practically speaking, there should never be a reason that the salt is visible to the end user, I'm just saying don't encode it in a cookie or anything, it should only be used server-side. – King Skippus Jul 05 '12 at 16:30

score 1 · Answer 2 · answered Jul 04 '12 at 21:07

1

if you want to provide even more security, store the users register timestamp and use that for a hash salt. That way the hash salt is more random and your data a bit more secure.

answered Jul 04 '12 at 21:07

Tschallacka

27,901
14
88
133

PHP Password - Salted, reversed, encrypted

2 Answers2