Does session hash matter?

Question

Does size matter when choosing the right algorithm to use the session hash.

I recently read this article and suggested using a jacuzzi to create a hash for the session ID. Whirlpool generates a 128-character hash string, is it too much?

The plan is to keep the session hash in db. Is there any difference between maybe using a 64-character field (sha256), a field with 96 characters (sha384) or 128 characters (jacuzzi)? One of the initial arguments made for whirlwind was speed versus other algorithms, but looking at the speed results, sha384 does not evaluate too poorly.

There is an option to trim the hash to make it less than 128 characters.

I modified the source code snippet to allow a change in the algorithm based on needs.

Update . Some opinion was expressed that the string hashed, so I included the code.

function generateUniqueId($maxLength = null) {
    $entropy = '';

    // try ssl first
    if (function_exists('openssl_random_pseudo_bytes')) {
        $entropy = openssl_random_pseudo_bytes(64, $strong);
        // skip ssl since it wasn't using the strong algo
        if($strong !== true) {
            $entropy = '';
        }
    }

    // add some basic mt_rand/uniqid combo
    $entropy .= uniqid(mt_rand(), true);

    // try to read from the windows RNG
    if (class_exists('COM')) {
        try {
            $com = new COM('CAPICOM.Utilities.1');
            $entropy .= base64_decode($com->GetRandom(64, 0));
        } catch (Exception $ex) {
        }
    }

    // try to read from the unix RNG
    if (is_readable('/dev/urandom')) {
        $h = fopen('/dev/urandom', 'rb');
        $entropy .= fread($h, 64);
        fclose($h);
    }

    // create hash
    $hash = hash('whirlpool', $entropy);
    // truncate hash if max length imposed
    if ($maxLength) {
        return substr($hash, 0, $maxLength);
    }
    return $hash;
}

Answer 1

The time to create the hash is not important, and as long as your database is properly indexed, the storage method should not be the main factor either.

, cookie. cookie . . Yahoo! . cookie, , .

, -, , . md5 sha1, , , .

Answer 2

, .

, . , .

, , , , .

, - - Whirlpool, 128 (32 ). , 128 .

, . , , , , , .

Answer 3

, , , . ; , , . ?

A hash accepts input, and if this input is predictable, then the hash is also bad.

Answer 4

SHA1 or MD5 is probably enough for your needs. In practice, the probability of a collision is so small that it is most likely not to happen.

Ultimately, it all depends on your level of security. Also keep in mind that longer hashes are more expensive to compute and require more memory.