Best Encryption technique [duplicate]

Question

This question already has answers here:

Secure hash and salt for PHP passwords (14 answers)

Closed 8 years ago.

I'm using PHP. I want a safe and fast password encryption system. Hashing a password a million times may be safer, but also slower. How to achieve a good balance between speed and safety? I want to know the best encryption method in php and how to apply it.

Answer 1

I recommend using the new PHP 5.5 password API. It provides a secure means of hashing a password, while being fast enough.

If you don't have PHP 5.5 available there is a polyfill that works with PHP 5.3.7+: https://github.com/ircmaxell/password_compat

Answer 2

Use PHPass, it is an excellent hashing framework and very easy to use!

Answer 3

Use SHA512 http://php.net/manual/en/function.hash.php. SHA512 is not cracked. I suggest to use a salt: Some random string that you append to the password before hashing. This can protect against precomputed rainbow tables but not against dictionary attacks if the attacker gains access to the database containing passwords and salts. SHA512(password + salt) --> hash Store hash and salt in the DB When checking password, retrieve salt corresponding to user, concatenate it with password, hash it and compare it with stored hash. Read here: How long to brute force a salted SHA-512 hash? (salt provided)

Thinking back about your question and particularly about your statement "Hashing a password a million times may be safer, but also slower. How to achieve a good balance between speed and safety". Indeed, repeatedly hashing will protect you against dictionary attacks by making it computationally prohibitively expensive to compute all hashes in a dictionary. I am not teaching you anything here. From the first link I gave you, it took around 46 milliseconds to calculate a SHA512 hash, which is relatively long. Out of hand I can think of the following factors that could influence your decision as you are in an arms race setting: - Increasing computing power (more CPU cores and GPU computations) - Improved Algorithms over time - Amount of money available to the attacker - The value to get out of your site if cracked (if low, it would not be worth the effort) against - Amount of CPU power you have at your disposal As a rule of thumb, I would hash as many times as possible so as to not impact my web site performance. Taking into account the number of logins per seconds, you can roughly calculate the amount of CPU power you can afford to spend without impacting your site performance.

One last comment: Assuming hackers already have access to the table containing the user names and hashed passwords, you might at that point be more worried about all the bad things they can do on your site.

Answer 4

your not looking for encryption - your looking for hashing.

I suggest openwalls phpass http://www.openwall.com/phpass/

If you are using PHP5.5 they have a password hasing API http://uk3.php.net/password

for more info.

MD5 (salt-less) has been used for a while a large number of lookup lists are around, Combined with modern hardware getting 700K + passwords per second it wont take long at all to "reverse" the password.

With a salt they are more secure, But still can be cracked quickly