What is the safest way to store a password using Code Igniter?

Question

I am using Code Igniter for my current project.

As of now, I am using MD5 for password hashing, but I have read at a lot of places, that it is not a good practice to do so.

What should I go with?

1. Using a salt
2. Or should I use bcrypt

Also, if bcrypt is recommended, then how to use it with Code Igniter?

EDIT

I have put these files in application/libraries

1. PasswordHash.php
2. c/Makefile
3. c/crypt_private.c

In my controller, I am using this code -

$params = array(
       'phpass_hash_strength' => 8,
           'phpass_hash_portable' => FALSE
       );
$this->load->library('PasswordHash', $params);
$password = $this->passwordhash->HashPassword($pwd);

I am getting these errors -

A PHP Error was encountered

Severity: Notice

Message: Uninitialized string offset: 3

Filename: libraries/PasswordHash.php

Line Number: 116

---

A PHP Error was encountered

Severity: Warning

Message: strpos() [function.strpos]: Empty delimiter

Filename: libraries/PasswordHash.php

Line Number: 116

---

Update

Removed PasswordHash.php, using SimpleLoginSecure now.

Answer 1

Use bcrypt. This discussion came up here in the comments to my answer. You can use a library such as phppass to really simplify the password encryption.

On the matter of salt. Use it! Otherwise somebody can simply go to this site and download the rainbow tables that will cover the large majority of passwords the average users chooses. Especially with all the security leaks in the last few months, now is not the time to be saying you won't use something as simple to implement as random salt.

UPDATE

To use PHPPass with CI, download and extract the files from the phppass website, linked above. Put the PasswordHash.php file into your CI application/libraries directory.

In your code, you then load the library via: $this->load->library('PasswordHash',array(8, FALSE));

Hashing passwords is then as simple as $this->PasswordHash->HashPassword($password);

To later check if a password is correct, it is as simple as:

$password = $_POST['password'];
$actualPassword = /*Get the hashed password from your db*/;

$check = $this->PasswordHash->CheckPassword($password, $actualPassword);

I've taken this demo from http://dev.myunv.com/articles/secure-passwords-with-phpass/ which gives you a lot more informations. I've modified that tutorial slightly to utilize CI's loader which is why you don't need the include or new statements.

Answer 2

why use md5() when it is just as easy to use sha1() ?

Also salting the passwords is always a good idea as it effectively removes the threat of a Rainbow Table attack

In my experience a salted SHA1 hash is pleanty secure for 99% of web application situations.

Answer 3

Code Igniter has changed since the time this question was asked. But for the benefit of some who may not have come across the extensive documentation of CI or haven't seen this before, CI has an encryption class which provides a two-way data encryption using the Mcrypt library of PHP.

After initializing the class using:

$this->load->library('encrypt');

You can encrypt as follows:

$msg = 'My secret message';
$encrypted_string = $this->encrypt->encode($msg);

and decrypt as follows:

$encrypted_string = 'APANtByIGI1BpVXZTJgcsAG8GZl8pdwwa84';
$plaintext_string = $this->encrypt->decode($encrypted_string);

CI also has a non-decodable 1-way hashing:

$hash = $this->encrypt->sha1('Some string');

For more information see: http://www.codeigniter.com/user_guide/libraries/encryption.html