CODEWITHSUNDEEP
hashencryption
pedalpete
pedalpete

Reputation: 21546

Hash Collision in fairly simple encrypt/decrypt code

I'm trying to add a small level of security to a site and encode some ids. The id's are already a concat of linked table rows, so storing the encryption in the db isn't very efficient. Therefore I need to encode & decode the string.

I found this great little function from myphpscripts, and I'm wondering what the chances are of collisions.

I really don't know much about these sorts of things. I'm assuming that the longer my key, the less collisions i'm going to have.

I could end up with more than 10 million unique concatenated ids, and want to be sure I'm not going to run into issues. 

function encode($string,$key) {
    $key = sha1($key);
    $strLen = strlen($string);
    $keyLen = strlen($key);
    $j=0;
    $hash='';
    for ($i = 0; $i < $strLen; $i++) {
        $ordStr = ord(substr($string,$i,1));
        if ($j == $keyLen) { $j = 0; }
        $ordKey = ord(substr($key,$j,1));
        $j++;
        $hash .= strrev(base_convert(dechex($ordStr + $ordKey),16,36));
    }
    return $hash;
}

Upvotes: 1

Views: 1020

Answers (1)

sleske
sleske

Reputation: 83599

I think you are a bit confused about this issue.

The problem of collisions only applies to mappings that are not 1-to-1, but "lossy", i.e. map several different inputs to one ouput (such as hashes).

What you linked to looks like an encryption/decryption routine (if it works correctly, which I didn't check). Encryption by definition means that there is a matching decryption, hence the mapping defined by the encryption cannot have collisions (as you could not decrypt in that case).

So your question, as posted, does not make sense.

That said, I would strongly suggest you do not use bandaids like encrypting IDs. Just store the IDs server-side and generate a session key to refer to them.

Upvotes: 5

Related Questions