Using crypt (), how does my application check passwords with randomly generated salts?

Question

I looked at the PHP cryptography function and a few questions on Stackoverflow, and I'm trying to find salted and hashed passwords.

I found this on the PHP community page:

<?php
function md5crypt($password){
    // create a salt that ensures crypt creates an md5 hash
    $base64_alphabet='ABCDEFGHIJKLMNOPQRSTUVWXYZ'
                    .'abcdefghijklmnopqrstuvwxyz0123456789+/';
    $salt='$1$';
    for($i=0; $i<9; $i++){
        $salt.=$base64_alphabet[rand(0,63)];
    }
    // return the crypt md5 password
    return crypt($password,$salt.'$');
}
?>

How does something like this compare with:

<?php
// Slightly modified example from PHP community page

$password = trim(mysql_prep($_POST['password']));

// Get the hash, letting the salt be automatically generated
$hashed_password = crypt($password);
?>

Here is an excerpt from another question :

However, the PHP crypt () function can use various hashes to compute the hash. When you prefix the salt with "$ 1 $" you get a hash with MD5. When you prefix with $ 2 $, you get a crypt with blowfish, which is more secure.

"$ 1 $" , . , , ! . PHP .

, ... , , , password salted hashed password, ... - , , crypt() , , ?

Answer 1

.

- , .
.

EDIT. ( ) .

Answer 2

, /.

, , , , / , , .

, / .

, , .

Answer 3

/etc/shadow, ( :):

username:${enctype}${salt}$HoPeFuLlYVerYloNGpassWOrDhAsh: ... ... ... 

. {enctype} - , {salt} - . , , , ( , ).

{enctype} crypt ( ):

          ID  | Method
          ─────────────────────────────────────────────────────────
          1   | MD5
          2a  | Blowfish (not in mainline glibc; added in some
              | Linux distributions)

          5   | SHA-256 (since glibc 2.7)
          6   | SHA-512 (since glibc 2.7)

, , PHP .

, :

root:$6$foobar$JKLsdiuoilI/KSJHDKUyjh/SHDKJyUYW(....)

, SHA-512, - "foobar" (, , foobar!).

() , . SLaks, ASCII. , PRNG HRNG, () , RNG.

Answer 4

No, you are doing it wrong. Use the solardesigner PHPASS to perform hashing and validation. Finally, never NEVER use your own ad-hoc scheme, as this requires trouble.