md5 questions

gingar

Hi All,

I know the syntax to use md5 is something like md5('thingy').

But when someone says to use md5 to pass values to them and the common key is 'theprettycommonkey'.

What do they mean? I can only guess that the common key is sort of like a algorithm to encrypt the word? if so, how do I do it?

Oh, another thing, is the md5 in php and the md5 in asp.net the same?

Many thanks!

jmrouleau

Read This
This allows you to choose the algorithm and give a key.

gingar

thanks!

but i got an error.

Fatal error: Call to undefined function: hash_hmac()

and all i did was this.

<?

$algo = "md5";
$data = "message";
$key = "monkeypie";

   $thingy = hash_hmac ( $algo, $data, $key);
   print "<br>".$thingy;

?>

do I need to include anything?

jmrouleau

Honestly...I don't know.

PHP.net doesn't seem to know much about it either.

gingar

lol, thanks anyway!!

I'm using php4 btw, incase its any issue.

Anyone knows?

Weedpacket

They might be referring to a salt, where instead of md5($whatever) you have md5("theprettymonkey".$whatever). Or maybe md5($whatever."theprettymonkey").

It's for (a bit of) added security.

[man]hash_hmac][/man]
(no version information, might be only in CVS)

So it's not in PHP4. Or in PHP5.1.1.

The [man]mcrypt[/man] extension isn't quite so bleeding-edge.

And yes, MD5 in PHP is the same algorithm as MD5 in ASP.NET by definition.

gingar

how do i un-encrypt a md5 encrypted key?

kitchin

No can do. It's a one-way hash.

gingar

ok. then how else can i pass values to other pages without posting forms?

cause passing it in the url will show the whole world vital information!

StevenJ

you can use the url

[url]http://w.....page.php&var=test[/url]

then

$_GET['var']

or you can use sessions.........

huntercjcarroll

can i assume that using the hash_hmac will make it harder to brute force it?

Weedpacket

No, picking a decent password in the first place will make it harder to brute force.

huntercjcarroll

someone said that you can't deencrypt md5, there isn't a function to do it but you can bbrute force it... not sure how thogh

Weedpacket

Maybe you should do a bit of Googling and find out what it means to "brute force" an algorithm.

nubs

This is a bit of a tardy reply. However, for the record, you CAN mathematically reverse engineer any type of hash system. The beauty of MD5 though is that, by current computing standards, it would take a few thousand years to "decrypt" an MD5 hash due to the randomness in the algorithm. Or so this was until recently. There are libraries nowadays with pre-written hashes to "weak" words/phrases that allow for successful guesses of a hash decryption. Those libraries contain somewhere over a million unique entries, so they are extensive and are only getting larger as time passes. Personally, I still consider MD5 to be secure enough especially when accompanied with an SSL connection.

thepeccavi

if you want to encrypt and then decrypt something, use encrypt() and decrypt()

Or, just use sessions (as said earlier), that's what I would do... sessions aren't as gard as they sound...