Best way to store passwords in mysql database?

Question

Possible duplicate:
What is the best way to store user information and username and password
How do you use bcrypt to hash passwords in PHP?

I am using md5 (), which I know is deprecated, and I hear that sha1 () is also unsafe. So, what is the best way to store and retrieve passwords in the database these days with security in mind? I would be very happy if you could give a small example.

Thanks!

Answer 1

I would recommend looking at bcrypt, as it can help with brute force attacks. http://codahale.com/how-to-safely-store-a-password/

You can find an example here.

Answer 2

You really have to use bcrypt to hash your passwords, it was designed specifically for hashing passwords.

Hashing functions for passwords should be slow (some computational time is needed). Most hashing algorithms, such as SHA-1 and MD5, or even SHA-256, are designed to work quickly, but this makes it an easy target for brute force attacks. The finished GPU is able to calculate about 8 gigabytes of MD5 hashes per second!

Do not be afraid to use bcrypt! This applies not only to sites with a high degree of protection, but their use can be as simple as using the md5 hash. It is recommended to use a well-known library, for example phpass , and if you want to understand how it can be implemented, you can read this article , where I tried to explain the most important points.

UPDATE:

Current versions of PHP offer password_hash () and password_verify () functions to handle passwords. Use them as follows:

// Hash a new password for storing in the database. // The function automatically generates a cryptographically safe salt. $hashToStoreInDb = password_hash($password, PASSWORD_DEFAULT); // Check if the hash of the entered login password, matches the stored hash. // The salt and the cost factor will be extracted from $existingHashFromDb. $isPasswordCorrect = password_verify($password, $existingHashFromDb); 

Answer 3

We use crypt with Blowfish:

 // Hash our password $hashed = crypt($plain_text_password, '$2a$08$' . substr(hash('whirlpool', microtime()), rand(0, 105), 22)); // Validate a password if (crypt($plain_text_password, $hashed) == $hashed)) { // Valid password } 

The $2a$ salt prefix (read docs) is what crypt instructs to use Blowfish. And assuming that the crypt(3) implementation in the base OS supports it, you get it "for free."

Answer 4

md5 \ sha1 + unique salt = best way

Not paranoid.

Answer 5

You can find many encryption codes or mix them, for example, as follows:

 sha1(md5(sha1($pw))); 

I find it unnecessary, so I use SHA512 hash("sha512",$pw);