开发者

What info can be extracted from my password hashing function? Is it reversible?

With t开发者_运维知识库he following switch case method

switch ($crypt_type) {
      case "MD5": $crypted_pass = md5($password); break;
      case "SHA1": $crypted_pass = sha1($password); break;

      case "DESMD5":
//jpap
//      $salt = substr($crypt_type, 0, 11);
        $salt = substr($p_password, 0, 11);
//jpap
        $crypted_pass = crypt($password, $salt);
        break;

      case "CRYPT":
//jpap
//      $salt = substr($crypt_type, 0, 2);
        $salt = substr($p_password, 0, 2);
//jpap
        $crypted_pass = crypt($password, $salt);
        break;

      default: 
        $crypted_pass = sha1($password); break;
    }

this is the hashed password it was produced

$1$lwnY.pgz$rm4Bwn0XmK7k4QawHi8Cz0

What info can be extracted by this? Is it safe?


Hash function cannot be reversed which is why they are ideal for storing password. For explanation why is that so, check out this SO Question how-come-md5-hash-values-are-not-reversible and see the accepted answer


The original password cannot be extracted from this, that's by definition. From the provided string, I can deduct that $CRYPT_TYPE is crypt and the used algorithm is md5 with salt 1wnY.pgz. You should not use a part of the password as salt for crypt as this is visible in the result.

It is safe in the sense that the original value cannot be calculated from the hash.

0

上一篇:

下一篇:

精彩评论

暂无评论...
验证码 换一张
取 消

最新问答

问答排行榜