Questions about crypt()

DeltaRho2K

OK, I understand Crypt() uses a 1 way Standard DES encryptioni algorithm...

My question is this:

I am writing a code for an administrative user/password login on a website, and was wondering how you all do it?

I am planning to write it so when the user creates their user name and password, they must also setup a PIN. (Kind of like an ATM)

What the thinking here is this:

If the user loses their password, they can input their username and PIN to change their password, because the pasword is going to be encrypted using crypt() and using the PIN as the "Salt".

The PIN will also be stored encrypted in the same manner except that it will salt iitself.

I figured this sounded secure enough (obviously, SSL would be better, but my webhost doesn't offer it, and I don't feel like spending several thousand dollars to put an SSL webserver in my own house...)

Any input as to how you all do it?

Thanks in advance,
Jacob

epp_b

What's really neat about this encryption function in PHP is that it uses the same algorithm as Apache uses for it's [FONT=courier new].htpasswd[/FONT] files.

If you're using Apache as your webserver, you should be able to set the ownership of an [FONT=courier new].htpasswd[/FONT] file so that PHP can write to the file. Then, have PHP server-side edit the file so that it, logically, is like this:

username:some_encrypted_password_with_crypt()_function

See...

Oh, and don't forget the [FONT=courier new].htaccess[/FONT] file 😉

batman

My lost pw form:


<body bgcolor="#FFFFFF">
<form name="form1" method="post" action="lostpw.php">
  <table width="486" align="center" style="border: 1px dotted; padding: 1px" border="0" cellspacing="0" cellpadding="4">
    <tr> 
      <td valign="top" width="96" rowspan="3"> 
        <div align="center"><br>
          <img src="img_logon.gif" width="72" height="72"></div>
      </td>
      <td valign="top" width="374" height="27"><b>Please enter your email address:</b></td>
    </tr>
    <tr> 
      <td valign="top" height="38"> 
        <input name="email_address" type="text" id="email_address">
      </td>
    </tr>
    <tr> 
      <td valign="top" height="60"> <b>Answer to secret question:<br>
        <input name="answer" type="text" id="email_address">
        <br>
        <br>
        Would you like your password mailed?</b><br>
        <input type="radio" name="mail" value="yes">
        Yes, please. 
        <input type="radio" name="mail" value="no">
        No, just tell me!<br>
        <br>
        <input type="submit" name="Submit" value="Recover My Password!">
        <input name="recover" type="hidden" id="recover" value="recover">
      </td>
    </tr>
    <tr> 
      <td height="0"></td>
      <td></td>
    </tr>
  </table>
</form>

My lost pw phpage:

<?
include 'db.php';

$mail = $_POST ['mail'];
$nomail = $_POST ['nomail'];
$email = $_POST ['email_address'];
$answer2 = $_POST ['answer'];

if((!$mail) && (!$nomail))
{
echo "Please tell us how you would like to receive your password. <br>";
include 'lost_pw.html';
exit();
}

if(!$answer)
{
echo "Please tell us what your secret answer <br>is in order to receive your password. <br>";
include 'lost_pw.html';
exit();
}


$sql_check = mysql_query("SELECT * FROM users WHERE email_address='$email'");
	$sql_check_num = mysql_num_rows($sql_check);
	if($sql_check_num == 0){
		echo "No records found matching your email address<br />";
		include 'lost_pw.html';
		exit();
	}


$sql = mysql_query("SELECT * FROM users WHERE answer='$answer' AND email_address='$email'");
$sql2 = mysql_num_rows($sql);

if($answer2 == $sql2)
{
	echo "I'm sorry, you did not give the correct answer!<br />";
	include 'lost_pw.html';
	exit();
}

$sql = mysql_query("SELECT pass FROM users WHERE email_address='$email_address'");
$row = mysql_fetch_array($sql);
$password = $row['pass'];





if($mail == 'no')
{
echo "<b>Your password is: <font color=red>$password</font></b> <br>";
include 'login_form.html';
exit();
}

else
{
	echo "<strong>Your password has been sent to your e-mail!</strong><br />";
	include 'login_form.html';


$subject = "Your Password for MSP Inc.!";
$message = "Hi, here is your password.

Password: $password

[url]http://www.1mspinc.com/login_form.html[/url]

Thanks!
The Webmaster

This is an automated response, please do not reply!";

mail($email_address, $subject, $message, "From: MSP Inc.<msp@starband.net>\nX-Mailer: PHP/" . phpversion());

}

?>

Just change the secret answer stuff to a pin. When the person registers, make the pin with the crypt() then call it with decrypt(), or you can also use the md5().

I'm sure you can play around with it and get it exactly how you want it.

-Blake

DeltaRho2K

THanks all...

Batman, does crypt() have a decrypt() function associated with it? I really don't want to have a way to recover a lost password, because I think that would make it a bit vulnerable.

What I am trying to do is like your form shows, just have a way to verify the account in the event of a lost password (the PIN).

The email will be sent with the encrypted password sent in a link to the verified email, tey click on. When they do, it will immediately prompt them to change the password. I got all of that part)

The question really is this: What is the best method to use to encrypt the password? Also, do you recommend encrypting the PIN as well? I have read a lot of the inherent problems with using MD5, since it wasn't designed for passwords.

What about crc32(), sha1() and crypt(). From what I understand, they are all 1 way encryption algorithms. crc32 can sometimes generate negative results, so you have to call it differently, but seems pretty good.