[Resolved] de-encrpyting md5

[fean0r]

how can I do this so I can send a user there password.... they get the encrpyted version atm 🙁

$pass= $row_items['password'];

[Ravenous]

In short, don't bother. Just generate a new one and send them that. If they don't like it, they can login and change it manually. If I remember correctly, MD5 hashes aren't supposed to be decrypt-able (Is that a word?).

Some guy on this board wanted to start up a massive database with the MD5 hash of as many words/character combinations as possible. I don't think it turned into much.

[ereptur]

MD5 isn't an encryption. It's a one-way hashing system to generate 128 bit unique hashes for any kind of input.

This is most useful for verifying file system integrity or used with other actual encryption methods to validate identity.

In short, you cannot decrypt MD5 because it's one-way. And you shouldn't be using it for validation, because someone can always just run a word-list through an md5 function until the hashes match.

[Mordecai]

Originally posted by ereptur
...because someone can always just run a word-list through an md5 function until the hashes match.

This is true, but only slightly more so than with any other password. Still, it is a security risk you should not be willing to take.

I use MySQL's PASSWORD() function, which is also one-way. I suggest using this and just generating a new password whenever they need to change it to something new (i.e. forgot it).

[fean0r]

Thanks

I use 2 cookies to hold a password and a username then I check them everytime a user opens a page within the members area.

Is there away to produce a random pass 16 digit pass?

[laserlight]

Well, you could use a pseudo-random number generator, and a script such as:

mt_srand((double)microtime() * 1000000);
$charlist = "qwertyuiopasdfghjklzxcvbnm1234567890";
$newpass = '';
$max = strlen($charlist) - 1;
for ($i = 0; $i < 16; $i++) {
	$randnum = mt_rand(0, $max);
	$newpass .= $charlist{$randnum};
}

though of course you could change the various parameters

[fean0r]

Thanks again 🙂