PHP - MD5, SHA, Hashing Security

Question

I am the developer of a new website created in PHP and I wonder what exactly is the best thing to hash. I looked at md5 and sha1, but is there anything more secure. I apologize if this is a nooby-related issue, but I'm new to PHP Security, and I'm trying to make my site as secure as possible. And what is salt?
Thanks,
Wasemem

Answer 1

Firstly, md5 and sha1 have proven that they are irreconcilable for collisions and can be a rainbow (when they see if your hash is the same in their shared password database).
There are currently two things that are safe enough for passwords that you can use.
The first one is sha512. sha512 is a sub-version of SHA2. SHA2 is not yet vonrable for collisions, and sha512 will generate a 512-bit hash. Here is an example of how to use sha512:

<?php hash('sha512',$password); 

Another option is called bcrypt. bcrypt is famous for its secure hashes. it is probably the safest of them and the most customizable. Before you start using bcrypt, you need to check if your server is turned on, Enter this code:

 <?php if (defined("CRYPT_BLOWFISH") && CRYPT_BLOWFISH) { echo "CRYPT_BLOWFISH is enabled!"; }else { echo "CRYPT_BLOWFISH is not available"; } 

If it returns that it is turned on, then the next step will be easy. All you need to do to execute bcrypt a password (note for more customization you need to see How do you use bcrypt to hash passwords in PHP? ):

 crypt($password, $salt); 

Now answer the second question. A salt is usually a random string that you add at the end of all your passwords when you use them. Using salt means that if someone gets your database they cannot check the hashes for shared passwords. Database validation is invoked using a rainbow table. You should always use salt when hashing!

Here are my evidence for SHA1 and MD5 attack vulnerabilities:
http://www.schneier.com/blog/archives/2012/10/when_will_we_se.html , http://eprint.iacr.org/2010/413.pdf , http://people.csail.mit.edu/ yiqun / SHA1AttackProceedingVersion.pdf , http://conf.isi.qut.edu.au/auscert/proceedings/2006/gauravaram06collision.pdf and Understanding collision weakness sha-1

Answer 2

The whole purpose of the salt is to slow down the attacker from comparing the list of pre-generated hashes against the target hash.

Instead of pre-calculating one "hashed" value for each plaintext password, an attacker needs to pre-compose 16384 "hashed" values ​​for each plaintext password (2 ^ 7 * 2 ^ 7).

This look pales today, but it was pretty big when the crypto function was first developed - the computational ability to pre-calculate that many passwords multiply the number of suspicious (text) passwords that you suspect (the dictionary) were pretty high.

Not much today, so we have things like shadow passwords, other key password functions besides a cryptogram, and every sizad who wants to choose a password that will not be displayed in the dictionary.

If the hashes you want to generate are for passwords, this is a well-accepted method for implementing them.

http://www.openwall.com/phpass/

Answer 3

If you plan to do this for passwords, do not use MD5 or SHA1 . It is known that they are weak and unsafe, even with salt.

If you use them for other purposes (for example, providing a hash of a file to confirm its authenticity or a random hash database column to provide a pseudo-random sort order), then they are accurate (down to the point), but not for passwords or anything else, what you consider necessary to keep safe.

The current best-use password algorithm is BCrypt with the appropriate password resolution.

And the best way to implement BCrypt password hashing in PHP is to use the PHP API of the new password. This API will be introduced as a set of built-in functions in the next version of PHP, v5.5, which is due out in the next few months. The good news is that they also released a backward compatibility version for users of current versions of PHP (5.3 and 5.4), so although PHP 5.5 is not yet released, you can start using the new API right away.

You can download the compatibility library here: https://github.com/ircmaxell/password_compat

Also: You asked what "salt" is. Since I already mentioned this a couple of times in this answer, I should consider this part of the question as well.

Salt is basically an extra line added to the password when it is hashed to make it more difficult to crack.

For example, an attacker may know in advance what hash value for a given password string, or even a series of specified password strings. If he can get your hashed data, and you have not used salt, then he can simply compare your hashes with his list of known passwords, and if any of your users uses an easily guessed password, they will crack in seconds, regardless of what hashing method was used.

However, if you added a secret extra line to the password when you use it, the hashed value will not match the standard hashes for the original password, which makes it difficult for an attacker to find this value.

The good news is that if you use the API I mentioned above, you don’t have to worry too much about the details of this, as the API handles the pickling for you.

Hope this helps.