(2010-08-13, 04:51 AM)KuJoe Wrote: [ -> ] (2010-06-18, 09:34 PM)MattRogowski Wrote: [ -> ]$stored_pass = md5(md5($salt).md5($plain_pass));
Thank you...there we go
(2010-08-13, 06:53 PM)pyridine Wrote: [ -> ]Wrong thread?
I click the multi-quote on the post, but it didn't quote the right one
Last time I checked, MD5 wasn't an encryption method. Lol.
Just so people know, the MD5 algorithm has not been cracked, however people reference MD5 values to a string stored in a database. Using a salting method or a character mixup algorithm, rainbow tables will come close to unuseable when trying to obtain the original state of the string.
Technically md5 and sha1 are both
cryptographic hashing functions, but are commonly used for encryption as well, since the hash can be substituted as an encrypted password. This combined with proper salting such as MyBB performs makes a very effective and secure password function.
I actually like the idea of the OTP encryption.
To generate a key we could basically use the same method as we do for the current salt... only pass it the length of the password to generate with. Or preferably the length of the password + salt.
$encrypted_pass = otp($salt.$plain_text_pass);
The otp key would be stored in the user table just like the salt and the finished encrypted passwd.
I always figured that all encryption algorithms can be reversed with another algorithm. Since the MD5 algorithm is not reversible as there is no link to the original data or string, then I assumed it would not be considered an encryption method.
The reason being is that the purpose of encryption is to hide the actual values of a specific data chunk. Unless the reader has access to the encryption key (which is used for decrypting the data to it's original form), then it would render useless to them. MD5 is primarily used for data integrity to ensure that it matches the specified value.
For instance, encryption would involve using an algorithm to hide the password on the client side, then pass it to the server, which would then use the encryption key to decrypt the encrypted string, which would then have the correct password and compare to the stored value. This stops people sniffing or repeating/modifying packet contents. However, with MD5 algorithms, the client would send the original password string, the server would obtain the MD5 value of the string, which would then compare the string they have stored in the database. The MD5 method is mainly used for any protection of password reading attempts on the server side.
It basically stops people from using SQL injection to obtain passwords from your database, or for you nosey administrator's to not be able to view a password without modification to the core coding.
(2010-08-16, 01:03 AM)Sleepwalker Wrote: [ -> ]I always figured that all encryption algorithms can be reversed with another algorithm. Since MD5 is not reversible as there is no link to the original data or string, then I assumed it would not be considered an encryption method. Learnt something new today.
You confuse encryption with ciphering. You can encrypt something without the ability to decrypt. A cipher has a key and is reversible. If my understanding of the terms is correct anyways.
In point of fact the crypt() function in C doesn't have a corresponding decrypt() function either, and was used as a password encryption routine in many softwares.
I know wikipedia is a terrible source of information but I can't help myself. Also, I edited my original post with much more information.
http://en.wikipedia.org/wiki/Encryption
Quote:In cryptography, encryption is the process of transforming information (referred to as plaintext) using an algorithm (called cipher) to make it unreadable to anyone except those possessing special knowledge, usually referred to as a key. The result of the process is encrypted information (in cryptography, referred to as ciphertext). In many contexts, the word encryption also implicitly refers to the reverse process, decryption (e.g. “software for encryption” can typically also perform decryption), to make the encrypted information readable again (i.e. to make it unencrypted).
The key part of that is the "In many contexts", in other words not all. But I guess my understanding of the term cipher was wrong
Now I've learned something new hehe
Just clarifying a couple of things here:
MD5 and SHA1 both use the same principles in their design. The only reason SHA1 is better to use is because it has less of a chance of collisions and uses a different ciphering algorithm.
These encryption algorithms are considered "one way" encryption algorithms. That means once encrypted you can't reverse the encryption to bring it back to it's original cleartext.
How is this done? This is based on a mathematical principle of "loss of information". Since there is an infinite amount of possibilities you can use for the input and the output is always a finite amount of possibilities of 32 characters for md5, and 40 characters for sha1 you have to either expand or compress this output to exactly 32 or 40 characters. That's exactly what these algorithms do.
f(x) = md5(x); md5(x) return 32 scrambled characters based on x;
Unfortunately because there is unlimited input possibilities and only limited output possibilities you create the effect known as collisions. This means that two different inputs can create the same output.
Fortunately for us, 32^36 and 40^36 possibilities makes it statistically-improbable for this to ever happen. You'd need dedicated super computers to come up with collisions.
In addition, if you theoretically plotted these encryption algorithms on a xy graph, because of the ability to have collisions this tells us that for any given y resultant, there are more then one x input. Just doing a simple horizontal line test and it would fail. This property of these encryption algorithms make it impossible to decrypt.
You could always brute-force every single combination (x) until there is a matching (y) resultant to the one you were looking for. Of course, this still doesn't mean that it's the right cleartext input (x) since these algorithms failed the horizontal line test.
And even then, to brute-force you would need a local copy of the database storing the hash information. Otherwise, the latency of the internet would cripple the brute-force attack. It would take millions of years to complete a full brute-force attack.
Make sense? lol
Ryan
You are spot on Ryan, but I still think it is better to classify MD5 and SHA-1 as hashing algorithms, not encryption algorithms. For instance, DES encryption can not be reversed without access to the algorithm's base key value although there is references to the key value itself in the encrypted data, however a hashing method has no reference to the initial value whatsoever and therefore can not be reversed using a reversed algorithm using the key value. People use encryption on packets being sent from client to server so the original content of the packet cannot be viewed or modified without access to the key value. Once it reaches the server, then they use the key value to obtain the original data. MD5 can not be used for this for the obvious reason.