1

Currently im using php5 for my hashing of my password. I want to know how to change the random salt for SHA512. After i change the following code from sha1 to sha 512, my hashing failed. Below is my code for hashing my password:

public function hashSSHA($password) {

    $salt = mhash(rand());
    $salt = substr($salt, 0, 15);
    $encrypted = base64_encode(bin2hex(mhash(MHASH_SHA512, $password . $salt, true) . $salt));
    $hash = array("salt" => $salt, "encrypted" => $encrypted);
    return $hash;
}

/**
 * Decrypting password
 * @param salt, password
 * returns hash string
 */
public function checkhashSSHA($salt, $password) {

    $hash = base64_encode(bin2hex(mhash(MHASH_SHA512, $password . $salt, true) . $salt));

    return $hash;
}

I managed to register a new user but when i try to log in with the registered user, it will tell me that my username or password is where. So i want to know where i have done wrong. thanks!

Jones Ch
  • 65
  • 2
  • 11
  • Don't use SHA to hash passwords; it's too fast. – SLaks Aug 21 '12 at 14:56
  • I agree with @SLaks. Read this very interesting post: http://stackoverflow.com/questions/4795385/how-do-you-use-bcrypt-for-hashing-passwords-in-php. If you don't change your mind about sha521, you can still use `BCrypt`'s `getRandomBytes($count)` method. – Tchoupi Aug 21 '12 at 14:57
  • if i use BCrypt then how do i integrate that into my code? I new to encryption. – Jones Ch Aug 21 '12 at 15:00
  • @JonesCh see http://stackoverflow.com/questions/4795385/how-do-you-use-bcrypt-for-hashing-passwords-in-php – Thomas Clayson Aug 21 '12 at 15:01
  • @SLaks: "Don't use SHA to hash passwords; it's too fast" What do you mean by "too fast?" Isn't fast a good thing? Thanks. – user1477388 Aug 21 '12 at 15:03
  • 2
    @user1477388: Too fast means that an attacker can try _many_ passwords per second. – SLaks Aug 21 '12 at 15:04
  • For your info, I am using php file to do my encryption for my user in my android app and store it to my database. – Jones Ch Aug 21 '12 at 15:04
  • Your salt is different every time. How do you expect hashing to work if you are constantly hashing different strings? – N.B. Aug 21 '12 at 15:10
  • Wouldn't it be better to put a restrain (5 attempts or 10 per minute per IP) than using a not-so-efficient method? Because, if thousands of real different users try to log in, you want your code fast. I think that even changing the IP should be slower than using a slower hash method. – Francisco Presencia Aug 21 '12 at 15:12
  • @FrankPresenciaFandos: Yes; you should do that too. But what if the attacker steals your database? – SLaks Aug 21 '12 at 15:54

1 Answers1

2

rand() is supposed to have a different value each time you use it, so the salt is different when the user registers and when he tries to log in. Try to give a static value to the salt, like 'sdfj3209r34r4' for example, and see if it works. This is weak though as everyone would have the same salt.

An alternative would be to use something that is not common for everyone but is also 'static'. This means that it's different from each user but keeps being the same for each user.

One example of the later would be to use a md5 of the password as the salt, the username, the user's city or whatever data that you have available that you know that it's NOT going to change (and if it changes, request the password and create the new hash, as many sites do). I didn't realize of it until now answering this question, that could be another reason why places as www.hotmail.com request the password when you change some 'private' information, because they have to rebuild the hash.

There is A LOT of information about salts in other stackoverflow questions.

EDIT. Try this:

public function hashSSHA($password) {

    $salt = mhash(MHASH_SHA512, $password);
    $encrypted = base64_encode(bin2hex(mhash(MHASH_SHA512, $password . $salt, true) . $salt));
    $hash = array("salt" => $salt, "encrypted" => $encrypted);
    return $hash;
}

/**
 * Decrypting password
 * @param salt, password
 * returns hash string
 */
public function checkhashSSHA($salt, $password) {

    $hash = base64_encode(bin2hex(mhash(MHASH_SHA512, $password . $salt, true) . $salt));

    return $hash;
}

Also, are you sure that your $salt inside checkhashSSHA is the same as the one done by hashSSHA? Because variables are LOCAL normally (they only work inside the same function). This means that you need to have the same script, $salt = mhash(MHASH_SHA512, $password);, outside the function to create the salt. If you do so, this is REALLY redundant, if you don't do so, the $salt has no value inside the second function. Please provide some more code.

Francisco Presencia
  • 8,732
  • 6
  • 46
  • 90