0

This question already has an answer here:

i was wondering if this is a secure method for a hashing password.if it is not secure please tell me what to do in order to make it secure

$pass='test'//the password
$salt=openssl_random_pseudo_bytes(225);//generate salt
$pre_hash_pass=hash('sha512',$pass);//pre hash the password
$final_pass=hash('sha512',$pre_hash_pass.$salt);//THE FINAL PASSWORD

the result(cropped for it being too long ).the full RESULT(ON GOOGLE DOCS)

=m]ˆÂýÇâ&-Ù©Þ}§˜ü=l|‹|oÓÌ×±[ý’p'lJÛ|›¦nXÝx܆9óÔ¢¤ÿ‰"µ^¾õJ JI^íó,•±†û½L›T0*Stÿ#s´Ë§ÔMgå.£J§èeRzù/‡üœ¿ª¡ ǹáuT¯ '0¯ÄŒÐ²A@ü •uuYRpýš™ü5%P—í¬ïr‚×ODÜ—´“„?”öÛž;Bí#Þcõ&¾qLEâ« |Z¯ÔÐö%R•9âǸ—•êäxZ³ÎɶÉêS\™!qóœ[)ÚúÞçøƒŠº¾*Ü/X"Œê@µð¶¨$p1£B5iÚ Ú†õʬɦE3^ür¾auD»ëêA)d„ÏHzYÁepƒê¬~ô¡œ8e‡ñˆÖM&èæ<ëâM"-¹uSÂÖøsBŒiÓÑ!³ÊÅwÛö>kHåO'dyÁ(<Ýx´Ÿì¸¤˜)èÀ©@ëQæ‚Ëã:04q-‡è—žÄ­"tÌÀ±IŒW1p–̇bïV¢¼-$»¥ˆlË*Ê^¡´ZK ×±›mßhœôNþ`‰û§4p9 þ]Ùö®u*)ú24qØI£–]†#8kÐ>a…t fö¾¶+k—a ?L¯¶ƒÎµÜz‘k†—)+¥qþÞ \®qÔª|ãO¹¥ô?I°®íɨ‘‡3 dÿë€ìV&"+Ï}*L퀟h"p  Ø"ð¶Øäç6ˆkƒ¹òÓ@FK²Ä?åüï<:CˆšÛƒ1J®b™ý)žy´ÔĶa™_Áïx^—õö6Ãqc€õš¾©÷M—¡å´7ÁÑ©Nà›¶AÚ¢öEM:"¶Ž4iáîµ&Cþ²Pû¶££.ÿ *?©ñÞ`&ÞGøó§¦_B¸‡h–¦éÞæ'裩n¥êý5‘¿kcñV‰1?xçÛ#”C0ÒÁià¿0Ÿ¥çWdŘ]íhæS'ã'–ÿðò§ü‡ì¨šãfïï Á0ó7kÀ%±N“£\Br)"úkl슢˜˜[’€:º–Í  GaùÛaçˆwsÔÚ‚õòSd›±ltWZ›è_¹ªÿã§%ÉÞxŸKÊMUYÜJ@Šý+BBL¤®Š±    „¼‚ÈûæÀŠBñã“„º/oú–·fJäƒrÀ°‡¤N2¸×kìô"aõÙ%ÚÂWŸÿ–†Œ»Còc?…£Rw4ËZ_W§{b™”î—/ľ›:ºj;U.½ÓM “É¥8T37?¿UÃh5Ľ>éÎÔášÄxÀ¥ä·$í÷äÕÖ·¿Oowç<ÖÅ!XNâjW”öb1GâÔ¯yYÇ+¶pL´[sŠÍT.×KXNK“kh-ñ@bÌÜ^Ü÷]é ¿}fkøD‡0GE îŽï˜;pÂsŠ¶ZfÀ§1gjõÂcøwãj•‡'BšÓ{»£¬²BhaA2ÿT Ë~S{‹øÏàïnñhÁn ýˆÜzŽ*`5ÉŽAsqaùðĶü¿ƒ 5g>ë¥Uå!-£SÂr–ELÿ*à&;½¤&›y™Ž6¼³ªø ȮMP÷G©‹:ø_•ÜAaA«jb;‹¨ÓŠĹ‰¤¼l*S ï?ö„óÑ    žsÌ=,&å x— a´è2éòyÄlÝŠ*žÄ¥ÆnÀ¨ã³¡ ÝòÆFƒDÁ*D   ;™±™½fÀßÃ¥‹{â«ZËÅøÁY‚Œ”².—ÆÀMuüÃÙR™;c6ì€Î®û°Éƒ„bЖ{íWáßõíì’¬¾ßaÙ°^læ¿r{ƒ,ãaì?ZÞ‚á>m9‚€’ѧÑú\VFÏ\b¶c'E¨)óå€Â˜¾bæ¿;nðî¶Äê=fè8cÊ©"¹K sF¢Æš³   ²ˆô6*®&Øç$î6ÐZÆú”Ž‹S¹)šå‡j¶ý¥¹3áBy+ìç°ÏHHg®™:ä`Oà^4Æ–(Øx$…ÖýdÎÞfvr"ÙCU¼Áë¸;½›ÂMy.fRlÓûñ9HÕ6V•.–‚“3¬ig_HSÀíñæ…ïþ­qž—7¾_;ó«(«ãøguBš"ã·pÓïvŠªÜ²•tÚÒ=Jî„d|¤MxžŠÝ’Œ>(K_>ÏQl¯?2šËŒÂ(twQû¡&­ÌøŸ=Þ‹%âAœ LÇNjnYNæø }iÏaQx‘dO6ô¬z`oÔÝ.Ç"~]1¼@Ô¸tÏnÀZì»g¤'ãÜÆ' MbOÆ@R,I.ŠhéD›PAn'3áyþ‡5±+  xßM|T‘~Ð3¦èd-ï`S•![¹·)ÓÿQ'!‰]½+lkŸ+©àtk«HÂË»Œ"Zï¨ÓCú «@

marked as duplicate by TildalWave, Adi, Rory Alsop Feb 25 '14 at 20:19

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • Sounds fine. Where are you going to store the salt? – Sandokas Feb 25 '14 at 18:08
  • im storing it in a mysql db but do you think that there are any vunerabilities ?anything at all – Immortal Dude Feb 25 '14 at 18:14
  • You could hash multiple times (more than just 2). Pick a random number like 53 or something. Makes it harder to crack if the DB gets exposed – CtrlDot Feb 25 '14 at 18:17
  • Like @CtrlDot says, if you're storing the salt in the same place as the username you might want to be a little tricky on the salt usage. If db gets compromised but code doesn't it might be harder to guess the encryption sequence involved. Your code is valid nevertheless. – Sandokas Feb 25 '14 at 18:25
  • 1
    No, it is not a valid method. The threat model of password storage is that the attacker will have access to the database and to the source code. He will be able to test candidates passwords and verify with the hash. This is why you salt the password in the first place, to slow him down. With that in mind, it will still be very fast for him to discover weak passwords with your scheme. Use bcrypt or PBKDF2 with many thousands of iterations. – Yolanda Ruiz Feb 25 '14 at 19:15
4

This is not secure. You have only 2 rounds of SHA-512, which is not computationally complex. Your salt is also a variable length (between 0 and getrandmax() bytes), which means storage will be unreasonably large (an average of 16 kilobytes of storage for each password?!).

Please do not attempt to create your own password storage system. Use one of the proven solutions: PHPass, bcrypt, PBKDF2, or scrypt

  • i need something that is native to php so if you could rule out the solutions for which i need to install something it would be very help full – Immortal Dude Feb 25 '14 at 19:22
  • @Mr.coder The bcrypt and PBKDF2 links are directly to php.net, so I assume they are included. – bonsaiviking Feb 25 '14 at 19:31
  • Your salt is also a variable length (between 0 and getrandmax() bytes) in place of rand() it is actually 225.does it make any difference – Immortal Dude Feb 25 '14 at 19:37
  • @Mr.coder That was really the least of your problems, but yes, a fixed-length salt is better for database storage. Really, really, really do not write this yourself. Use an established method or you will regret it. – bonsaiviking Feb 25 '14 at 19:44
  • 2
    ok switching to bcrypt – Immortal Dude Feb 25 '14 at 20:10

Not the answer you're looking for? Browse other questions tagged or ask your own question.