Question Regarding Password Feilds

Saintless

I am not sure if i should be posting this here or not but yes i am a noobie 🙂 So may as wel.

I am currently trying to create a place online for a few people to store there passwords for various utilites .

Now that being said my requirements are kind of stumping me.

What i need is to secure the password feilds so that they are not viewable incase the DB is compromised. So obviously i need to have the passwords encrypted.

Now my issue is that when a correctly authenticated user attempts to view there list i need that password to be in clear text.

So to make a long story short.

Encrypted in the db.
Clear Text for authenticated user.

Any help at all would be really appretiated i have been hitting my head againts the wall on this one.

Only thing i can find that may work is mcrypt

sheephat

md5

http://uk3.php.net/manual/en/function.md5.php

Saintless

Thanks sheephat

I was actually reading over that.

What i a alittle hazy on is how to decrypt the md5 has so that it will show the passwords in clear text once the use is authenticated.

I am a total noob when it comes to this.

sheephat

you cant decrypt it,

if you use md5(string) to has the password and store it into the database

then use md5(string) in the form, the md5 generated will be the same

the beauty of it is that you cannot take the md5 and generate it back, you can use the username and extra text to make the hash stronger.

Saintless

Okay so if i follow you correctly Which i probaly dont

When i store the passwords i would use md5(string)

Then on the form when i want to see the passwords i would use md5(string) again

And it would output the passwords in clear text?

sheephat

This is what i gues your tring to do, is you have a form which registers users, and you have a log in form which logs users in.

On your register form you need to generate the md5hash of the password chosen, forexample 'sheephat' generates 19ae708df0e65fb9d3c9540ac2ab653f.

Which you would then store into the database as my password.

Then on your log in form the password field would have to match, so if we have md5($_POST['password]); and i type sheephat the exact same thing (19ae708df0e65fb9d3c9540ac2ab653f) will generate. Then validate that the md5 matches.

This will secure your passwords from being readable or decrypted.

NogDog

If you want to store data in an encrypted form and then decrypt it later, you'll probably either want to look into the PHP [man]mcrypt[/man] functions, or if using MySQL to store the data then its encryption/decryption functions.

Saintless

NogDog

Thank you that is exactly what i am looking for.

Mcrypt will do the job however currently i do not have it built in.

however the mysql conversion does intrest me. I guess i will have to do some research in regards to implementing it.

Once again thank you.

sheephat

I didnt read your post properly which is why i was raving on about md5,

Research is good, im off to do mine on mcrypt.

Saintless

Yeah i am thinking i will end up using mcrypt as well. Seems like a much better choice.

However now i have to look into doing md5 checksums on log files.