What info can be extracted from my password hashing function? Is it reversible?
With t开发者_运维知识库he following switch case
method
switch ($crypt_type) {
case "MD5": $crypted_pass = md5($password); break;
case "SHA1": $crypted_pass = sha1($password); break;
case "DESMD5":
//jpap
// $salt = substr($crypt_type, 0, 11);
$salt = substr($p_password, 0, 11);
//jpap
$crypted_pass = crypt($password, $salt);
break;
case "CRYPT":
//jpap
// $salt = substr($crypt_type, 0, 2);
$salt = substr($p_password, 0, 2);
//jpap
$crypted_pass = crypt($password, $salt);
break;
default:
$crypted_pass = sha1($password); break;
}
this is the hashed password it was produced
$1$lwnY.pgz$rm4Bwn0XmK7k4QawHi8Cz0
What info can be extracted by this? Is it safe?
Hash function cannot be reversed which is why they are ideal for storing password. For explanation why is that so, check out this SO Question how-come-md5-hash-values-are-not-reversible and see the accepted answer
The original password cannot be extracted from this, that's by definition. From the provided string, I can deduct that $CRYPT_TYPE
is crypt and the used algorithm is md5 with salt 1wnY.pgz
. You should not use a part of the password as salt for crypt
as this is visible in the result.
It is safe in the sense that the original value cannot be calculated from the hash.
精彩评论