CODEWITHSUNDEEP
md5sha256password-encryption
Tloz
Tloz

Reputation: 113

Converting encryption password from MD5 to SHA-256, does my protocol has a flaw?

I'm working on a website (PHP + MySQL) that I've got to upgrade. Passwords are stored in the database in MD5, and I'd like it to be something more secure, like SHA-256.

I've already red this question about "converting" password hashes, but I got an other idea, and I'd like to know if it brings a security problem or not.

Currently, the passwords are checked in php by hashing (in MD5) the given password and compare it with the hash stored in database, ie: if(md5($password) == $hash)

Let's assume that I hash all the MD5 hashes in SHA-256. I'd have the sha-256 hash of a md5 hash.

Side note: I know it's not more secure to rehash a hash, that's not the point of my question

When a user wants to connect, I'd just have to change the md5($pass) in hash('sha256', md5($password), false) to make it match the value stored in database (assuming $password is the right one)

It seemed a good idea to me as I don't need to keep track of the md5 hash after conversion, ad this doesn't need me to create any new column in my table. I know that this is not going to give me the SHA-256 hash of the original password stored with md5 hash, but this is not my goal. It's just to change the encryption method. Moreover, brute-forcing it seems inefficient, as it is very unlikely that dictionary would have hashes of words...

Does this way of doing it is flawed?

Upvotes: 0

Views: 1747

Answers (1)

zaph
zaph

Reputation: 112857

Simple hashing of passwords is insufficient, it is subject to rainbow tables and is to fast.

Instead in PHP use Safe Password Hashing: password_hash() and password_verify() or a comparable function such as PBKDF2, Bcrypt or script. These function are more secure because of two additions: a repetition count and a random salt. It's all about raising the work factor the attacker must perform.

After all, the point is to have a secure system. Just making it more inconvenient for an attacker is not the answer, there are hacking programs out there to take advantage of poor password security.

Upvotes: 3

Related Questions