7

How do I use the sha512 function for PHP?

Can I replace all my md5 functions with the sha512 function?

Do I have to download something if so what?

Can anyone provide examples?

BenMorel
  • 34,448
  • 50
  • 182
  • 322
PeAk
  • 155
  • 1
  • 1
  • 3

3 Answers3

6

The hash() function, provided with PHP >= 5.1, should be able to generate sha512 hashes -- you can verify this calling the hash_algos() function, that lists the supported hashing algorithms.


For example, you could use :

$sha512 = hash('sha512', "Hello, World!");
var_dump($sha512);

And you'd get :

string '374d794a95cdcfd8b35993185fef9ba368f160d8daf432d08ba9f1ed1e5abe6cc69291e0fa2fe0006a52570ef18c19def4e617c33ce52ef0a6e5fbe318cb0387' (length=128)


And, on my system, the following portion of code :

$supported = hash_algos();
var_dump($supported);

Indicates that 42 hashing algorithms are supported :

array
  0 => string 'md2' (length=3)
  ...
  6 => string 'sha384' (length=6)
  7 => string 'sha512' (length=6)
  8 => string 'ripemd128' (length=9)
  9 => string 'ripemd160' (length=9)
  ...
  40 => string 'haval224,5' (length=10)
  41 => string 'haval256,5' (length=10)


Also, with PHP >= 5.3, you should be able to use the openssl_digest() function :

$sha512 = openssl_digest("Hello, World!", 'sha512');
var_dump($sha512);

(Yep, the parameters are not in the same order as with hash() -- the magic of PHP, here...)

And, to get the list of supported algorithms, you could use openssl_get_md_methods().

On my system, this one gives me 22 supported algorithms.

Pascal MARTIN
  • 395,085
  • 80
  • 655
  • 663
  • If your software needs to run on multiple machines, make sure it will be available on all of your machines. – TheJacobTaylor Apr 02 '10 at 18:18
  • Can you provide a simple password login example, if its not asking to much :) – PeAk Apr 02 '10 at 18:25
  • 1
    That's a bit more complicated that this ^^ But the basic idea is : get the password the user posted ;; hash it ;; compare that hash to the hashed-password that's stored in the database for the login the user provided ;; if they match, it's OK, and you can set something in `$_SESSION` to indicate the user is logged-in. – Pascal MARTIN Apr 02 '10 at 18:31
0

Checksums are for generating checksums, HMAC is perhaps the preferred way for generating salted hashes of strings requiring securing hashing.

hash_hmac('sha512', 'important string', 'salt');
squeeks
  • 1,269
  • 11
  • 14
-2

Just out of curiosity, why do you want to replace the MD5 function?

It is relatively efficient. If you add a salt, it is really annoying to reverse engineer. Someone would have to perform a brute force encoding of all passwords looking for a match. Without a salt, common short strings lower case all letter strings have been cracked and stored in a database.

I would just add a salt and call it good.

halfer
  • 19,824
  • 17
  • 99
  • 186
TheJacobTaylor
  • 4,063
  • 1
  • 21
  • 23
  • how would I do a salt more importantly how would I generate a random salt? – PeAk Apr 02 '10 at 18:19
  • 1
    MD5 is cryptographically broken: http://www.google.com/search?q=md5+cryptographically+broken – Jacco Apr 02 '10 at 19:37
  • I view MD5 as a quick and efficient encoding algorithm, not as an encryption algorithm. Adding a sufficient salt will make it more painful to reverse engineer the passwords. I would also use a salt that is not in the database. You are correct though, with enough time and willpower, you can definitely come up with a password that will match a presented MD5. If I were changing to a better algorithm, I would go for something much higher, it will save having to upgrade again for a long time. – TheJacobTaylor Apr 02 '10 at 21:35
  • I hope your sufficient salt is *random* and *different for every hash*. Otherwise, you are largely defeating their purpose: http://stackoverflow.com/questions/1645161/salt-generation-and-open-source-software/1645190#1645190 – Jacco Apr 13 '10 at 09:12
  • 2
    And yes, MD5 is quick. But that is exactly what you do NOT want for hashing passwords. – Jacco Apr 13 '10 at 09:15
  • 2
    (For clarity, I've downvoted this for the material about MD5 being suitable for password hashing, not because it needed editing). – halfer Feb 23 '19 at 21:29
  • 1
    also @halfer you don't want a efficient algorithm...Because off precalucated rainbow tables, GPU bruteforcing pretty sure that was also a thing 10 years back.. Also a salt does not change all of that besides where to you store the salt? – Raymond Nijland Feb 23 '19 at 21:32
  • 1
    @RaymondNijland: as I understand it, salts can be left in the table, and can be expected to be known to an attacker. The point is not that these can be kept secret - these are just to prevent pre-existing rainbow tables being used. The main defence here, as you say, is slowing the attacker down. – halfer Feb 23 '19 at 21:38
  • "salts can be left in the table, and can be expected to be known to an attacker" well what i used to be doing @halfer before `password_hash()` was a thing.. i would generate a salt based on the primary id with auto_increment with a datetime with a defualt current_timestamp.. i would insert a record then get the last_insert_id(), fetch the id and datetime and that i would use it as a salt and update that complete record meaning the salt was dynamic but never (really) known in the table. – Raymond Nijland Feb 23 '19 at 21:44
  • Yes, that sounds like a good salt. Prior to the built-in functions becoming available, I tried to use well-tested libraries to plug the gap - it is a good rule of thumb not to do any hashing or encrypting unless one is a cryptographer! Thankfully there was a library that made `password_hash` available from PHP 5.3.3, so that not being available was a long time ago... – halfer Feb 23 '19 at 21:44