Encrypting Passwords with PHP for Storage Using the RSA PBKDF2 Standard

Andrew Johnson (ITNewb Guru) wrote Nov 22, 2009

Hey sonofsuns,

I'm guessing you meant to comment on the mcrypt article, not this one... For older versions of PHP you're right, but as far as newer versions it shouldn't be necessary.

Note: As of PHP 4.2.0, there is no need to seed the random number generator with srand() or mt_srand() as this is now done automatically.

I should have put it though, with a comment. Thanks for bringing this up.

srand( (double)microtime()*1000000 ); // needed for PHP < 4.2.0

sonofsuns (Site Newb) wrote Nov 22, 2009

Hi,

please don't forget to initialize the random number generator when using mcrypt_create_iv in connection with MCRYPT_RAND.

php.net:

Note: When using MCRYPT_RAND, remember to call srand() before mcrypt_create_iv() to initialize the random number generator; it is not seeded automatically like rand() is.

Otherwise, great class!

Joel Vardy (Site Newb) wrote Sep 22, 2009

Hiya Rocky, there is a lot of information regarding encryption methods built into mysql here : http://dev.mysql.com/doc/refman/5.1/en/encryption-functions.html

This article is specifically looking at php functions, which are not transferable through mysql, if you are using php to connect to your database I would consider encrypting and decrypting strings outside of the mysql query.

this could be as simple as:

$password = $_POST['password'];
$password = pbkdf2($password , 'some salt here', 1000, 32);
$query = "select * from `users` where `password` = '$password'";

Hope this is what you meant, Joel

Roky (Site Newb) wrote Sep 22, 2009

What about MySQL support? It is nice when you can do select like SELECT MD5('smt')

Hot Spots

Information

Powered By

Requirements

Copyright / Usage