return back the value generated using MD5 fubction

[eros]

I use md5 function of PHP before storing the password in the database.

Scenario: I put an password retrieval program. After authentication that the username is realy exist, send an email containing his/her password and username.

Problem: I cannot return back the encrypted value.
e.g. password: 123456 md5 password: sdfgn234uih893hu9hu92rh8g58...... (32size in DB)

I want back the real value to "123456".

Constraits: I dont want to generate new password before do the email. I want to send back his/her currently used password.

[dafodil]

After a few argument with volectricity about hashing I came to a point to understand that hashing cannot be decrypted. The only way you can check if the hashed data is the same is by storing a hashed data to your db and comparing it to user input by hashing it.

MD5 returns a hashed data.

What you need is a two way encryption function.

[eros]

After a few argument with volectricity about hashing I came to a point to understand that hashing cannot be decrypted. The only way you can check if the hashed data is the same is by storing a hashed data to your db and comparing it to user input by hashing it.

MD5 returns a hashed data.

What you need is a two way encryption function.

Please correct me if my understanding is wrong.

I will create a list of hashed data by md5 and corresponding real values? Maybe it is adding another field or another table?

What do you mean by two-way encryption function?

[eros]

It means that if the site have a capabilities to send back the original password is not using a md5 function.. maybe created their own encryption function, that's they can decrypt the data. Or they are not using any encryption in storing passwords in the database.

[dafodil]

Please correct me if my understanding is wrong.

I will create a list of hashed data by md5 and corresponding real values? Maybe it is adding another field or another table?

What do you mean by two-way encryption function?

MD5 is only one way encryption that means you cannot decrypt it. You cannot retrieve the old value. The only way is by comparing the stored hashed data on the database.

For example:
use md5:
apple=EDFAB
store EDFAB to database.
you need to allow user to input his password again:
apple
and use the md5 again to compare it.
EDFAB=EDFAB

I suggest you to use mcrypt: http://www.php.net/manual/en/ref.mcrypt.php

If you want to decrypt what you have encrypted.

[eros]

MD5 is only one way encryption that means you cannot decrypt it. You cannot retrieve the old value. The only way is by comparing the stored hashed data on the database.

For example:
use md5:
apple=EDFAB
store EDFAB to database.
you need to allow user to input his password again:
apple
and use the md5 again to compare it.
EDFAB=EDFAB

I suggest you to use mcrypt: http://www.php.net/manual/en/ref.mcrypt.php

If you want to decrypt what you have encrypted.

Thanks a lot...I study on how to excute mcrypt in PHP.

[nathj]

If you want to decrypt what you have encrypted.

Remember, if you can decrypt so can someone else. I suggest sticking with hashing and if they forget their password, have them prove who they are and then generate a new password - they can always change it when they log in next.

I think, and it's really just opinion, that being able to decrypt the password is not smart. Sticking with hashing, it's safer.

Cheers
nathj

[eros]

Remember, if you can decrypt so can someone else. I suggest sticking with hashing and if they forget their password, have them prove who they are and then generate a new password - they can always change it when they log in next.

I think, and it's really just opinion, that being able to decrypt the password is not smart. Sticking with hashing, it's safer.

Cheers
nathj

I see... yeah I realized... hihih ;) thanks you very much..I regenerate a new password then email to their respective email account then just change it after.

Thanks again. I will for MD5 function of PHP.

[kovik]

I see... yeah I realized... hihih ;) thanks you very much..I regenerate a new password then email to their respective email account then just change it after.

Thanks again. I will for MD5 function of PHP.

Don't use MD5. It's so outdated and weak. I'd suggest SHA-256, but SHA-1 is easily available through PHP, so use it.

[php]$pass = sha1($_POST['password']);[/php]

[eros]

Don't use MD5. It's so outdated and weak. I'd suggest SHA-256, but SHA-1 is easily available through PHP, so use it.

[php]$pass = sha1($_POST['password']);[/php]

It is advisable? and it is the common practice?

[dafodil]

There are already security flaws for Sha-1 and MD5. You can check this site to see the available hash functions.
http://en.wikipedia.org/wiki/Cryptog...hash_functions

[kovik]

It is advisable? and it is the common practice?

It's stronger, but just as easily available for use, so there's really no reason to use MD5 over SHA-1.