PHP-Encryption

[hismajesty]

Why does this generate errors?

Code Select Expand

Md5(crypt(base64_encode($password)))

[Spht]

Why does this generate errors?

Code Select Expand

Md5(crypt(base64_encode($password)))

I hope you're kidding.

[hismajesty]

Why does this generate errors?

Code Select Expand

Md5(crypt(base64_encode($password)))

I hope you're kidding.

Sadly I'm not...I don't understand why encrypting something three ways would generate an error...
(It doesn't help that I'm just learning php either)

[Spht]

Why does this generate errors?

Code Select Expand

Md5(crypt(base64_encode($password)))

I hope you're kidding.

Sadly I'm not...I don't understand why encrypting something three ways would generate an error...
(It doesn't help that I'm just learning php either)

I don't know PHP. But that's like saying

Code Select Expand

MyReturn = MyFunction(DoesThis(AndThis(ToThis)))
Why doesn't this work???

You may need to post your Md5, crypt, base64_encode functions which could be buggy and causing the error.

[hismajesty]

Those functions are all built into PHP. I guess I'll just do

Code Select Expand

Md5($password) instead, I was just thinking that it being encrypted three times would make it more secure and what not.

[Spht]

Those functions are all built into PHP. I guess I'll just do

Code Select Expand

Md5($password) instead, I was just thinking that it being encrypted three times would make it more secure and what not.

That works? Try:

Code Select Expand

base64_encode($password)
crypt($password)
Md5($password)

[Banana fanna fo fanna]

Ugh@spht

If you're looking for one-way encryption, pretty much the best you can get is double-SHA, that is, SHA the data once, then append a "session key" (if applicable) and hash again. If there are no such session keys, one time will suffice.

[Archangel.]

hrm.

   <FORM>
      <INPUT TYPE=TEXT NAME=code VALUE="<?echo $code?>">
      <INPUT TYPE=SUBMIT NAME=action VALUE="Encode">
      <INPUT TYPE=SUBMIT NAME=action VALUE="Decode">
   </FORM><BR>
   <?
      if($action == "Encode") {
         echo "<B><FONT FACE=Arial>Output:</FONT></B><BR>";
         echo base64_encode($code);
      } elseif($action == "Decode") {
         echo "<B><FONT FACE=Arial>Output:</FONT></B><BR>";
         echo base64_decode($code);
      }
   ?>

[Yoni]

Hash(Base64 of password) and Hash(Plaintext password) are equally secure. If all you're going to do is calculate a hash, encoding as base64 is unnecessary. See also St0rm's post.

Base64 by itself offers zero security. Its purpose is not security. Its purpose is to encode any data to a form that contains only printable characters, with an overhead of only 33% (as opposed to, for example, an overhead of 100% with encoding as Hex).

[hismajesty]

Project, that was a pointless. We've already established that base64 was pointless; thus, the reason that I wasn't satisfied using just base64. Base64 is easily decoded with the base64_decode function of php; thus, it's a pointless form of encrypting. Anyways, I just decided to do MD5 hashing only.

[CrAzY]

hrm.

   <FORM>
      <INPUT TYPE=TEXT NAME=code VALUE="<?echo $code?>">
      <INPUT TYPE=SUBMIT NAME=action VALUE="Encode">
      <INPUT TYPE=SUBMIT NAME=action VALUE="Decode">
   </FORM><BR>
   <?
      if($action == "Encode") {
         echo "<B><FONT FACE=Arial>Output:</FONT></B><BR>";
         echo base64_encode($code);
      } elseif($action == "Decode") {
         echo "<B><FONT FACE=Arial>Output:</FONT></B><BR>";
         echo base64_decode($code);
      }
   ?>

Looks like a Visual Basic programmer.

[Archangel.]

Uhhh sorry if it was to late... i just said my idea...
and Crazy a little Vb, cant do a nice work like you or other people, i still need to learn .
And Shadowed is teaching me php, heh, he is a god, he made Psi Ops.

[Arta]

What are you trying to do exactly? If you're saving a password as a cookie or something, remember that in most cases, obtaining the hash of a password is equally as useful as obtaining the password itsself.

Hashing != Insta-secure.

[UserLoser.]

Code Select Expand

MyReturn = MyFunction(DoesThis(AndThis(ToThis)))
Why doesn't this work???

ROFL

[Kp]

What are you trying to do exactly? If you're saving a password as a cookie or something, remember that in most cases, obtaining the hash of a password is equally as useful as obtaining the password itsself.

Hashing != Insta-secure.

This depends in part on who he's trying to protect against.  If he's dubious about who else might be reading through the stored data, hashing the password server side is good enough if the intruder can only read saved data (cannot listen to your chat with the client).  Failure to do this is what got Trance (in part, anyway): the passwords were stored cleartext, and a malicious individual had read access to the password storage medium.  If the passwords had been stored as a hash, it would have taken at least a little bit of work for the attacker to determine Trance's password in cleartext form.

If the hash is computed client side, then, as you say, obtaining the hash is as good as having the password - for purposes of impersonating the user.  However, even in this case, having the hash of the password would not immediately grant knowledge of the user's cleartext password, so you could only impersonate him/her in this one location.

In my opinion, a good compromise between effort and security is to take the approach Blizzard uses -- a two layer hashing of the password, with the server remembering the one-pass hash and recomputing the two-pass hash from the stored data + the challenge/response cookies.