[Resolved] Field size to store encrypted passwords?

[bunner_bob]

I'm building a content management system. To access the admin portion of the CMS, users login using a username and password. The passwords are stored in a mysql table called 'users'. On INSERT or UPDATE, I do:

...SET password=password('$pass')...

So I guess I'm using MySQL's password hashing function, right?

1. Is this a decent way to do this? Seems pretty cryptic to me, but what do I know...

2. How large should the receiving 'password' database field be? Right now it's set to VARCHAR(16), and it does fill up with 16 characters when I input, say, an 8-character password. Should I make the field bigger, or a different field type?

I'm not getting any errors, which I might expect if the hashing function was making, say, 32 character encryptions but only storing 16 of them, then trying to compare the user input with the stored item. But again, just because it works doesn't mean I'm doing it right. Any advice appreciated!

Thanks!

• Bob

[nemonoman]

PASSWORD() is NOT recommended for the use you have. SHA1() is the recommended method: it returns a 40 char string:

from mysql.com:

PASSWORD(str)
Calculates and returns a password string from the plaintext password str, or NULL if the argument was NULL. This is the function that is used for encrypting MySQL passwords for storage in the Password column of the user grant table.

mysql> SELECT PASSWORD('badpwd');
-> '7f84554057dd964b'

PASSWORD() encryption is one-way (not reversible). PASSWORD() does not perform password encryption in the same way that Unix passwords are encrypted. See ENCRYPT(). Note: The PASSWORD() function is used by the authentication system in MySQL Server, you should not use it in your own applications. For that purpose, use MD5() or SHA1() instead. Also see RFC 2195 for more information about handling passwords and authentication securely in your application. 

SHA1(str)
SHA(str)
Calculates an SHA1 160-bit checksum for the string, as described in RFC 3174 (Secure Hash Algorithm). The value is returned as a string of 40 hex digits, or NULL if the argument was NULL. One of the possible uses for this function is as a hash key. You can also use it as a cryptographically safe function for storing passwords.

mysql> SELECT SHA1('abc');
-> 'a9993e364706816aba3e25717850c26c9cd0d89d'

SHA1() was added in MySQL 4.0.2, and can be considered a cryptographically more secure equivalent of MD5(). SHA() is synonym for SHA1().

[bunner_bob]

Lovely - thanks.

That's what happens when you learn everything from books. So cool to get the real-world feedback.