Better MD5 Function! ??

[fr600]

A guy gave me these codes and said thisi s better md5 function

function en_bmd5($txt,$pow,$tng){
   $exs = explode(",",$pow);
   $exu = explode(",",$tng);
   $ret = "";
   if(count($exu) != count($exs)){
      return "1";
   }else{
      for($i=0;$i<strlen($txt);$i++){
         if($i != 0){
            $ret .= "-";
         }
         $str = $txt{$i};
         $orn = ord($str);
         for($j=0;$j<count($exu);$j++){
            $num= $exs[$j];
            $mt = $exu[$j];
            if($mt == "a"){
               $orn += $num;
            }else if($mt == "s"){
               $orn -= $num;
            }else if($mt == "m"){
               $orn *= $num;
            }
         }
         $ret .= $orn;
      }
      return $ret;
   }
}

function de_bmd5($txt,$pow,$tng){
   $exs = explode(",",$pow);
   $ext = explode("-",$txt);
   $exu = explode(",",$tng);
   if(count($exu) != count($exs)){
      return "Hacking Detected!";
   }else{
      $ret = "";
      for($i=0;$i<count($ext);$i++){
         $orn = $ext[$i];
         for($j=(count($exu)-1);$j>=0;$j--){
            $num = $exs[$j];
            $mt = $exu[$j];

        if($mt == "a"){
           $orn -= $num;
        }else if($mt == "s"){
           $orn += $num;
        }else if($mt == "m"){
           $orn /= $num;
        }
     }
     $ret .= chr($orn);
  }
  return($ret);
   }
}

Can you please tell me how is this better than the original md5 function?

[drew010]

wow thats pretty funny that he thinks its better than md5. all it seems to do for me is turn each letter from a string into its ascii code and then put a - between them.
md5 is a hash function, which generates an irreversable 256bit value. with your friends function its a few simple additions, subtractions, and divisions and converting to and from ascii codes. sure md5 has been cracked by people who have put together 100,000$ supercomputers and let it sit there and crack for months on end, but i can practically decode those messages from his script by looking at them since i know most ascii codes.

[fr600]

LOL, thanks for the reply. I got it!!

[planetsim]

Hmm, I was unaware that md5 was actually cracked, I am however aware that a collision was detected. Now md5 depending on how you use it is still relatively safe I believe they can only crack (find a collision) with 8 alphanumeric and 16 number or alpha hashes. You can prevent this by attaching a salt (basically just a string which is predefined) and you attach it to another string that you require to use md5 with. If you want more security there is [man]sha1[/man] however even a collision was found with this.

[drew010]

heres some stuff on the guy who broke md5 and sha0 and sha1
http://www.technewsworld.com/story/35926.html

well its really not much but you coudl probably search for more.

[laserlight]

md5 is a hash function, which generates an irreversable 256bit value.

MD5 generates a 128-bit hash, not a 256-bit hash.

Actually, collision attacks arent that much of a concern if you're just storing hashed passwords. Attempts to discover the original password from the stored password hash requires a pre-image attack.

The current collision attacks on SHA1 are just theoretical at this point of time - though that's enough to consider it broken from a cryptographer's point of view.

You can prevent this by attaching a salt (basically just a string which is predefined) and you attach it to another string that you require to use md5 with.

A salt makes the use of rainbow tables more difficult, it doesnt really make sense to talk about using a salt in the context of collision attacks, from what I see. After all, you have to know the original message, so a salt is quite useless.

[drew010]

correct, 128bit hash, 256bit string.

[fr600]

Currently i'm use:
$password=md5('password');

Is it more secure if i use:
$password = md5(sha1('password'));

Sorry, I'm not a php expert. 🙁

[drew010]

ive seen things done before like

$secret = "4sd9t3";

$password = md5($secret . md5($password));

and the secret key is different for every user and is stored in a database.

[Drakla]

fr600 wrote:

Currently i'm use:
$password=md5('password');

Is it more secure if i use:
$password = md5(sha1('password'));

Sorry, I'm not a php expert. 🙁

Nope.

[fr600]

I found few simple function to encrypt password. Here are two:

function hash($text){
$hashtext = "secret-text";
return md5($text.$hashtext);
}

function md5x($var) {
return strrev(md5(md5(strrev(md5("$var")))));
}

Can you guys please tell me which one is more secured?

[bsgrules]

Drakla wrote:

Nope.

I would think it would be more secure. Why do you say it isn't.

[laserlight]

Sorry, I'm not a php expert.

By itself, this doesnt have very much to do with PHP, actually.

and the secret key is different for every user and is stored in a database.

This 'secret key' is the salt that planetsim referred to earlier.

Can you guys please tell me which one is more secured?

Since you are hashing a password, presumably for storage, your main concern is that an attacker cannot obtain the original password from the hash. For that purpose, your first example is sufficient, though you probably should use sha1() instead of md5().

The same reasoning applies for your earlier question. Using MD5 against SHA1 may actually increase the chance of a collision, so you might as well use SHA1 directly. In both cases it should be computationally infeasible (at this point of time) to obtain the original password from the hash.

[Drakla]

bsgrules wrote:

I would think it would be more secure. Why do you say it isn't.

Laserlight hits it right on the head: because of the increased possibility of collision. A sha1 output is always the same length, and does have the possibility of two passwords producing the same output, the same applies for md5, so you're putting a risk inside another risk, increasing it. Of course the possibility is still minute, but you're better off using one alone than one inside the other. I've seen some people concatenate an md5 and sha1 on the same password with a different salting string for each, but unless you're doing something pretty damn special it's just overkill.

[fr600]

Since that value of salt cannot be changed later, what values are better to use? I mean it's better to make it complex, isn't it. So how can I exactly make it complex?

[drew010]

what exactly are you storing. keep in mind just because these guys found collisions in the algorithm doesnt mean its still not safe for most people. of course government has their own algorithms. but unless you think people are gonna spend a really long time trying to crack your database (assuming they are able to get their hands on it) you should not worry.

[fr600]

I'm storing users password

[Drakla]

As far as Mr. md5 and Mrs Sha are concerned they take a string as input, and don't give a bloody monkeys what it is - a salting string of one character the same as War and Peace, preface and all. Now your only worries are if somebody does a dictionary attack using predictable words to match your salt. Just type some gibberish, use that. And that is the end of it.

[bsgrules]

Drakla wrote:

Laserlight hits it right on the head: because of the increased possibility of collision. A sha1 output is always the same length, and does have the possibility of two passwords producing the same output, the same applies for md5, so you're putting a risk inside another risk, increasing it. Of course the possibility is still minute, but you're better off using one alone than one inside the other. I've seen some people concatenate an md5 and sha1 on the same password with a different salting string for each, but unless you're doing something pretty damn special it's just overkill.

But thats assuming if the attacker knows that you've md5'd your original string. How is he suppose to know unless he sees your script.

[Drakla]

Because the question asked WAS:

Is it more secure if i use:
$password = md5(sha1('password'));

Understand?