What info can be extracted from my password hashing function? Is it reversible?

Question

With the following switch case method

switch ($crypt_type) {
      case "MD5": $crypted_pass = md5($password); break;
      case "SHA1": $crypted_pass = sha1($password); break;

      case "DESMD5":
//jpap
//      $salt = substr($crypt_type, 0, 11);
        $salt = substr($p_password, 0, 11);
//jpap
        $crypted_pass = crypt($password, $salt);
        break;

      case "CRYPT":
//jpap
//      $salt = substr($crypt_type, 0, 2);
        $salt = substr($p_password, 0, 2);
//jpap
        $crypted_pass = crypt($password, $salt);
        break;

      default: 
        $crypted_pass = sha1($password); break;
    }

this is the hashed password it was produced

$1$lwnY.pgz$rm4Bwn0XmK7k4QawHi8Cz0

What info can be extracted by this? Is it safe?

score 1 · Accepted Answer · edited May 23 '17 at 10:24

1

Hash function cannot be reversed which is why they are ideal for storing password. For explanation why is that so, check out this SO Question how-come-md5-hash-values-are-not-reversible and see the accepted answer

edited May 23 '17 at 10:24

Community

1
1

answered Sep 13 '11 at 11:58

momo

21,233
8
39
38

score 0 · Answer 2 · answered Sep 13 '11 at 11:59

The original password cannot be extracted from this, that's by definition. From the provided string, I can deduct that $CRYPT_TYPE is crypt and the used algorithm is md5 with salt 1wnY.pgz. You should not use a part of the password as salt for crypt as this is visible in the result.

It is safe in the sense that the original value cannot be calculated from the hash.

What info can be extracted from my password hashing function? Is it reversible?

2 Answers2