Encryption / Decryption

Question

I know that there are more than a dozen questions about this. But I want to know if it would be better to encrypt passwords for the login system using hash methods like sha1, sha512, etc., Or would it be better to use Mcrypt ciphers for this?

I know that decryption after encryption using hash methods like sha is not possible, and if encryption using mcrypt is possible. But is it safe to use mcrypt as you can also decrypt?

Answer 1

Passwords cannot be recovered . Their essence is to make sure that if the database is compromised, the attacker cannot gain access to each password and, therefore, to each user account (and to every account in other services where the password was reused).

Answer 2

For a password repository where you do not need plaintext passwords, you should always use Hash-Function. Thus, you can check passwords, but a potential attacker cannot find passwords with clear text (this is true when users always use the same password)

Answer 3

Passwords MUST NOT be recovered. So you need to use hashing algorithms. The most popular are MD5 and SHA1 . I will not suggest using MD5 because it can be easily attacked, and there are many hashes generated. SHA1 is better, but it has one too. The safest is SHA256 / SHA512 (part of the SHA2 family) based on this . Although the problem with the SHA2 family is that it is very much based on SHA1. It is not broken yet, but it may soon be torn. If you have time, you can transfer one of the algorithms made for the SHA3 contest or a less well-known algorithm. If you can install extensions, then competitors of SHA3 already have PHP extensions.

A good table for the security level is on Wikipedia . And if you choose, you must “attack with a collision” with [algorithm] "and [preimage attack on [algorithm]" to see if there is an attack there (Wikipedia may be outdated).

Also, do not forget to salt. This means that you haveh $ string + "Whatever" instead of $ string.