Re: [PHP] crypt salt question

No chance. Unless you have the salt stored along each password, your passwords are as good as random texts

Satyam



----- Original Message ----- From: "Andras Kende" <andras@xxxxxxxxx>
To: <php-general@xxxxxxxxxxxxx>
Sent: Thursday, August 30, 2007 11:42 PM
Subject: [PHP] crypt salt question


Hello,



I'm trying to move some app from postgresql to mysql but unable to find out
how to authenticate

against the current crypted passwords with php..



insert to database:



$cset = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789./";
$salt = substr($cset, time() & 63, 1) . substr($cset, time()/64 & 63, 1);
$password = crypt($password, $salt); //pass crypted version of password
for further processing



$result = pg_query ("INSERT INTO users (username, password) VALUES
('$username', '$password')");



I read the crypt is one way encryption but how to compare the password
entered with the encrypted

version if don't know the salt ??





Thanks,



Andras




--------------------------------------------------------------------------------


No virus found in this incoming message.
Checked by AVG Free Edition.
Version: 7.5.484 / Virus Database: 269.12.12/979 - Release Date: 29/08/2007 20:21
.

Relevant Pages

  • Re: Proposal for Lite Encryption for Login Form without SSL
    ... This way the password is not sent to the server ... simply copy the server-side salt used to hash the pw in the ... This would be the equivalent to a public key in public key encryption ... library or function that's readily available for both js and php. ...
    (comp.lang.php)
  • Re: Proposal for Lite Encryption for Login Form without SSL
    ... This way the password is not sent to the server ... simply copy the server-side salt used to hash the pw in the ... This would be the equivalent to a public key in public key encryption ... library or function that's readily available for both js and php. ...
    (comp.lang.php)
  • RE: [PHP] crypt salt question
    ... Actually the random salt is always the first 2 character of the encryoted ... Subject: [PHP] crypt salt question ...
    (php.general)
  • Re: How to encrypt/decrypt a file
    ... Modified to use random IV value (and random salt). ... (and for CTR mode of operation counter IV gives much better IND-CPA security). ... get a cryptographically random salt (different for each encryption invocation) ... and the server is watching that this exact data is not stored on the server... ...
    (microsoft.public.dotnet.security)
  • Re: How to encrypt/decrypt a file
    ... However random IV (in addition to password's salt) is better and more secure solution anyway. ... (and for CTR mode of operation counter IV gives much better IND-CPA security). ... get a cryptographically random salt (different for each encryption invocation) ... even so your customer's requirement looks quite strange - the server is processing the data and the server is watching that this exact data is not stored on the server... ...
    (microsoft.public.dotnet.security)