Password encryption: md5() vs. crypt()

[Ryan Lange]

I've seen md5() suggested a lot when it comes to password encryption, but
I'm wondering what the advantage is over using crypt(). Or is it just
personal preference?

- Ryan

[Nikolai Chuvakhin]

"Ryan Lange" <cl*********@comcast.net> wrote
in message <op**************@www.cl1mh4224rd.com>:

I've seen md5() suggested a lot when it comes to password
encryption,

No, you didn't. MD5 is not an encryption algorithm, it is a
hashing algorithm. Data processed by MD5 cannot be "decrypted",
unless some brute force approach is used.

Cheers,
NC

[J.O. Aho]

Ryan Lange wrote:

I've seen md5() suggested a lot when it comes to password
encryption, but I'm wondering what the advantage is over using crypt().
Or is it just personal preference?

As Nikolai says, md5 isn't a crypt but a hash algorythm.
crypt() works in the same way as md5(), one way algorythms (hash), while md5()
does only support md5-algorythm crypt() does support DES, MD5 and Blowfish (of
course depending on the system PHP is built on).

The disadvantige to use crypt(), is that the system you are developint the PHP
scripts on my support DES while the machine which you later on run the scripts
on may not support DES and then your scripts won't work properly. Otherwise
the two functions are quite the same.
//Aho

[Philipp Kern]

I answer this on comp.lang.php only.

On 2004-05-31, Ryan Lange <cl*********@comcast.net> wrote:

I've seen md5() suggested a lot when it comes to password encryption, but
I'm wondering what the advantage is over using crypt(). Or is it just
personal preference?

md5() could encrypt password of an finite length, crypt() only up to 8 chars if
I remember correctly.

Bye,
phil
--
Please send replys (not followups) to the address set in Reply-To.
Philipp Kern - PK2186-RIPE - http://www.philkern.de

[Ryan Lange]

On 31 May 2004 02:04:38 -0700, Nikolai Chuvakhin <[e-mail]> wrote:

No, you didn't. MD5 is not an encryption algorithm, it is a
hashing algorithm.

Damnit. You know what I mean... :P

- Ryan

[Philipp Kern]

I answer this on comp.lang.php only.

On 2004-05-31, Ryan Lange <cl*********@comcast.net> wrote:

I've seen md5() suggested a lot when it comes to password encryption, but
I'm wondering what the advantage is over using crypt(). Or is it just
personal preference?

md5() could hash passwords of an finite length, crypt() only up to 8 chars if
I remember correctly.

Bye,
phil
--
Please send replys (not followups) to the address set in Reply-To.
Philipp Kern - PK2186-RIPE - http://www.philkern.de

[Nikolai Chuvakhin]

"Ryan Lange" <cl*********@comcast.net> wrote
in message news:<op**************@www.cl1mh4224rd.com>...

On 31 May 2004 02:04:38 -0700, Nikolai Chuvakhin <[e-mail]> wrote:

MD5 is not an encryption algorithm, it is a hashing algorithm.

Damnit. You know what I mean... :P

Then you know the answer to your question, too; storing passwords
as MD5 hashes ensures that if they are stolen by individuals who
have acess to password storage, be they hackers or rogue system
administrators, those individuals cannot use them. Compare with
encryption, where rogue sysadmins can run unchecked...

Cheers,
NC

[Philipp Kern]

On 2004-06-01, Nikolai Chuvakhin <[e-mail]> wrote:

Then you know the answer to your question, too; storing passwords
as MD5 hashes ensures that if they are stolen by individuals who
have acess to password storage, be they hackers or rogue system
administrators, those individuals cannot use them.

But they could still crack them. The advantage of crypt() is then
that the password could be longer than passwords crypted with the
standard DES algorithm in UNIX password files.
crypt() is quite easy to crack, especially when the same salts
are used everywhere. Just a matter of time and the power of the
machine the attacker uses.

Bye,
phil
--
Please send replies (not followups) to the address set in Reply-To.
Philipp Kern - PK2186-RIPE - http://www.philkern.de

[Philipp Kern]

On 2004-06-01, Nikolai Chuvakhin <[e-mail]> wrote:

Then you know the answer to your question, too; storing passwords
as MD5 hashes ensures that if they are stolen by individuals who
have acess to password storage, be they hackers or rogue system
administrators, those individuals cannot use them.

But they could still crack them. The advantage of crypt() is then
that the password could be longer than passwords crypted with the
standard DES algorithm in UNIX password files.
crypt() is quite easy to crack, especially when the same salts
are used everywhere. Just a matter of time and the power of the
machine the attacker uses.

Bye,
phil
--
Please send replies (not followups) to the address set in Reply-To.
Philipp Kern - PK2186-RIPE - http://www.philkern.de