• Welcome to Valhalla Legends Archive.
 

PHP-Encryption

Started by hismajesty, December 22, 2003, 09:28 PM

Previous topic - Next topic

hismajesty

Why does this generate errors?
Md5(crypt(base64_encode($password)))

Spht

Quote from: hismajesty on December 22, 2003, 09:28 PM
Why does this generate errors?
Md5(crypt(base64_encode($password)))


I hope you're kidding.

hismajesty

#2
Quote from: Spht on December 22, 2003, 09:32 PM
Quote from: hismajesty on December 22, 2003, 09:28 PM
Why does this generate errors?
Md5(crypt(base64_encode($password)))


I hope you're kidding.

Sadly I'm not...I don't understand why encrypting something three ways would generate an error...
(It doesn't help that I'm just learning php either)

Spht

Quote from: hismajesty on December 22, 2003, 09:36 PM
Quote from: Spht on December 22, 2003, 09:32 PM
Quote from: hismajesty on December 22, 2003, 09:28 PM
Why does this generate errors?
Md5(crypt(base64_encode($password)))


I hope you're kidding.

Sadly I'm not...I don't understand why encrypting something three ways would generate an error...
(It doesn't help that I'm just learning php either)

I don't know PHP. But that's like sayingMyReturn = MyFunction(DoesThis(AndThis(ToThis)))
Why doesn't this work???


You may need to post your Md5, crypt, base64_encode functions which could be buggy and causing the error.

hismajesty

Those functions are all built into PHP. I guess I'll just do Md5($password) instead, I was just thinking that it being encrypted three times would make it more secure and what not.

Spht

Quote from: hismajesty on December 22, 2003, 09:42 PM
Those functions are all built into PHP. I guess I'll just do Md5($password) instead, I was just thinking that it being encrypted three times would make it more secure and what not.

That works? Try:base64_encode($password)
crypt($password)
Md5($password)


Banana fanna fo fanna

Ugh@spht

If you're looking for one-way encryption, pretty much the best you can get is double-SHA, that is, SHA the data once, then append a "session key" (if applicable) and hash again. If there are no such session keys, one time will suffice.

Archangel.

hrm.

   <FORM>
      <INPUT TYPE=TEXT NAME=code VALUE="<?echo $code?>">
      <INPUT TYPE=SUBMIT NAME=action VALUE="Encode">
      <INPUT TYPE=SUBMIT NAME=action VALUE="Decode">
   </FORM><BR>
   <?
      if($action == "Encode") {
         echo "<B><FONT FACE=Arial>Output:</FONT></B><BR>";
         echo base64_encode($code);
      } elseif($action == "Decode") {
         echo "<B><FONT FACE=Arial>Output:</FONT></B><BR>";
         echo base64_decode($code);
      }
   ?>
aka: Archangel, i can't login into the account or request the password, weird problem.

Yoni

Hash(Base64 of password) and Hash(Plaintext password) are equally secure. If all you're going to do is calculate a hash, encoding as base64 is unnecessary. See also St0rm's post.

Base64 by itself offers zero security. Its purpose is not security. Its purpose is to encode any data to a form that contains only printable characters, with an overhead of only 33% (as opposed to, for example, an overhead of 100% with encoding as Hex).

hismajesty

Project, that was a pointless. We've already established that base64 was pointless; thus, the reason that I wasn't satisfied using just base64. Base64 is easily decoded with the base64_decode function of php; thus, it's a pointless form of encrypting. Anyways, I just decided to do MD5 hashing only.

CrAzY

Quote from: ProjecT on December 25, 2003, 11:59 AM
hrm.

   <FORM>
      <INPUT TYPE=TEXT NAME=code VALUE="<?echo $code?>">
      <INPUT TYPE=SUBMIT NAME=action VALUE="Encode">
      <INPUT TYPE=SUBMIT NAME=action VALUE="Decode">
   </FORM><BR>
   <?
      if($action == "Encode") {
         echo "<B><FONT FACE=Arial>Output:</FONT></B><BR>";
         echo base64_encode($code);
      } elseif($action == "Decode") {
         echo "<B><FONT FACE=Arial>Output:</FONT></B><BR>";
         echo base64_decode($code);
      }
   ?>

Looks like a Visual Basic programmer.
CrAzY

Archangel.

Uhhh sorry if it was to late... i just said my idea...
and Crazy a little Vb, cant do a nice work like you or other people, i still need to learn :o.
And Shadowed is teaching me php, heh, he is a god, he made Psi Ops.
aka: Archangel, i can't login into the account or request the password, weird problem.

Arta

What are you trying to do exactly? If you're saving a password as a cookie or something, remember that in most cases, obtaining the hash of a password is equally as useful as obtaining the password itsself.

Hashing != Insta-secure.

UserLoser.

Quote from: Spht on December 22, 2003, 09:40 PM
MyReturn = MyFunction(DoesThis(AndThis(ToThis)))
Why doesn't this work???

ROFL ;D

Kp

Quote from: Arta[vL] on December 27, 2003, 05:04 PMWhat are you trying to do exactly? If you're saving a password as a cookie or something, remember that in most cases, obtaining the hash of a password is equally as useful as obtaining the password itsself.

Hashing != Insta-secure.

This depends in part on who he's trying to protect against.  If he's dubious about who else might be reading through the stored data, hashing the password server side is good enough if the intruder can only read saved data (cannot listen to your chat with the client).  Failure to do this is what got Trance (in part, anyway): the passwords were stored cleartext, and a malicious individual had read access to the password storage medium.  If the passwords had been stored as a hash, it would have taken at least a little bit of work for the attacker to determine Trance's password in cleartext form.

If the hash is computed client side, then, as you say, obtaining the hash is as good as having the password - for purposes of impersonating the user.  However, even in this case, having the hash of the password would not immediately grant knowledge of the user's cleartext password, so you could only impersonate him/her in this one location.

In my opinion, a good compromise between effort and security is to take the approach Blizzard uses -- a two layer hashing of the password, with the server remembering the one-pass hash and recomputing the two-pass hash from the stored data + the challenge/response cookies.
[19:20:23] (BotNet) <[vL]Kp> Any idiot can make a bot with CSB, and many do!