What is better with salt for password storage?
MD5:
$hash = md5($password . $salt); Password_hash:
$hash = password_hash($password, PASSWORD_DEFAULT, $salt); SHA1:
$result = sha1($salt.$string); 
- 1I'm voting to close this question as off-topic because it is about analysing security properties and has no programming question.Duncan Jones– Duncan Jones2015-03-19 14:40:30 +00:00Commented Mar 19, 2015 at 14:40
- Take a look at stackoverflow.com/questions/2235158/…bog500– bog5002015-03-19 14:43:11 +00:00Commented Mar 19, 2015 at 14:43
- You are correct. This does deal with security. No programming here as far as I can see.Noah Gary– Noah Gary2016-06-06 14:56:39 +00:00Commented Jun 6, 2016 at 14:56
Add a comment |
2 Answers
You should absolutely use the password_hash() function without providing your own salt:
$hash = password_hash($password, PASSWORD_DEFAULT); The function will generate a safe salt on its own. The other algorithms are ways too fast to hash passwords and therefore can be brute-forced too easily (about 8 Giga MD5 per second).
Salts are great when you are storing lots of passwords, otherwise they are fairly useless since they are stored in plaintext. If an attacker manages to get your hashed passwords, then assume that they can get their hands on your salts. Use SHA-256 because it's a cryptographically strong hash function, and use salts. But most importantly, just use strong passwords combined with strong hashing algorithms.
