3
votes
2answers
402 views

Is mt_rand() suitable for generating a salt?

Assumed I have to following code in order to generate a random blowfish salt for saving a new password: $blowfishCharacters = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789./'; $salt ...
0
votes
1answer
599 views

How do I generate a blowfish password hash in Ubuntu?

What's the command line to generate a blowfish password hash? I can't seem to figure this out at all. Apache's htpasswd only supports bcrypt, and openssl passwd doesn't even do blowfish hahes (but it ...
2
votes
2answers
300 views

In this example why do they hash a randomly generated piece of salt before hashing it with the password?

From here, in the code return substr(sha1(mt_rand()),0,22); what is the point of taking the sha1 value? It is appended to the password and together they are hashed using Blowfish. Why not just append ...
1
vote
3answers
825 views

Preventing dictionary attacks against hashed passwords [duplicate]

Possible Duplicate: How to securely hash passwords? I have a website and on that website I use SHA-256 and salt my user's passwords. What I'm doing right now is padding each letter of the ...
4
votes
7answers
1k views

What is the best way to securely keep clear passwords?

I'm working on a web project that will connect to a database. For that, I will have to store the login/password of that database user in clear (encrypted in a symmetrical way) in order to be able to ...