CODEWITHSUNDEEP
phphash
wtm
wtm

Reputation: 166

PHP - How safe/strong is this hashing?

So I am trying to "create" a strong hashing algoritme, and now I am wondering, how strong is it?

This is what I have came up with:

function bHash($text, $salt)
{
  foreach (array_reverse(hash_algos()) as $hash) {
    $hash .= hash($hash, $text . $hash . $salt);
   }

  return "_bH/" . $salt . "/" . str_replace("/", "+", crypt($hash, $salt));
}

echo bHash($password, "KB8NtFIN"); // I am using a different salt for each password!

So I am taking each hashing in the hash() function, and I hash it over and over again with salt (8 random string+hashname)

Which results in, for example "hello" is: _bH/KB8NtFIN/KBumi3+cVUUtU

So, how safe/strong is this?

Upvotes: 2

Views: 152

Answers (1)

Martin
Martin

Reputation: 22770

PHP - How safe/strong is this hashing?

Short Answer: not very.

Longer short answer: It isn't very strong compared to industry standards such as PGP or varios bCrypt implementations.

Longer answer: I don't want to rip off the answers provided in this Security StackExchange Post but please, read that link, read these very long and very detailed answers as to the numerous and various pitfalls of your own hashing algorithm.

  • Obfuscation is not hashing, just because you can't read it doesn't mean no one else can.

  • As Zaph mentioned, Schneiers Law is a relevant issue here.

  • If you change the salt every time, what is the point of having the salt at all? The salt needs to be recognisable by the algorithm, take a very simple example: You have algebra which states a = b + c . The minimum number of equations you can use to find value of a is the number of unknown variables. So in this case 2 (one for b and one for c), so if you have hash = salt + password if you only then have one equation (the hash) you can't find both the salt and the password values from within the hash...

  • what if your salt contains the / character? What if your password contains the / character?

P.s> Also the links to IRCMaxwells stuff posted by JimL are well worth reading too.

Upvotes: 4

Related Questions