Encryption security in php [duplicate]

You do not store passwords in the database, instead you store the hashes, and use this as a comparison when you have to log in.

MD5 and SHA1 are single hand , you can not break, but there are ready-made tables that have an infinity of MD5 and their meanings, as well as SHA1 I'd say SHA1 is a bit safer because it's a little slower.

To make it difficult for a weak password to be exposed if your database is leaked, use some salt.

[salt]+[hash-da-senha]

  

Salt : Randomly generated string that is used to generate the result of the hash of your password, usually stored in the database next to the generated hash.

Implementation example

// Entrada do usuário
$input = 'minhasenha123';

// Gera o hash da senha do usuário
$hash = password_hash($input, PASSWORD_BCRYPT); 

// Hash gerado (cada vez será único)
echo $hash;

// Deve ser armazenado no banco e usado para comparação.

Let's assume that the above code produced the following result:

$2y$10$OOCtogTSo0egjw1ZUHXndei8h/sZGNQh.iKBn9L2T4VbYvSGFEnP.

Each time we run it is unique, but we have saved the hash in the database, and now we will use it to compare the login.

// Entrada do usuário no login
$input = 'minhasenha123';

/**
 * Código para pegar a hash do banco correspondente
 * ao usuário que tentou fazer login
 *
 * Aqui para exemplo, vamos usar a string, mas em sua aplicação
 * deve-se comparar qual usuário solicitou, se ele existe,
 * trazer a hash da senha usuário para uma variável, e compara-la
 * com o input do login
 */

$hash = '$2y$10$OOCtogTSo0egjw1ZUHXndei8h/sZGNQh.iKBn9L2T4VbYvSGFEnP.';

// Faz a verificação

if (password_verify($input, $hash))
{
    echo 'Usuário logado';
}
else
{
    echo 'Senha inválida';
}

I also recommend that you use the slowest and most robust PASSWORD_BCRYPT (yes, slower, it is essential to deliberately slow down performance when it comes to encryption, so your system is less vulnerable to brute-force attacks.)

  

Note : The password_hash function is available in versions 5.5 or higher of PHP.

This is the simplest implementation and has a lot of security.

Information security is a much more complex subject than choosing this or that template.

Safety is always something connected to us humans. Passwords, for example, only need to exist to prevent those who do not own such information can have free access to them.

Passwords are like locks on any door. In a safe or low risk environment, there is no need for complex locks. Nobody puts a lock on the dog's house. On the other hand, no one will put a lock on the door of a bank vault.

Any encryption template has failures. The more secure, more costly to maintain.

There is no point in having a 4096-bit password encryption system if the pass-through password is open between the form and the passcode.

The most basic security model of a WEB system mainly passes through the point of origin of the data. If there is a real need for security, you have to start with the SSL environment. It is only from this that one should consider opting for this or that model of access key.

For systems with low risk of leakage of useful information, using md5 or sha1 already solves.

In time, base64 is not hashed and should never be used as encryption. It serves to transform a string with harmful characters into strings with pure ASCII characters.

md5 and sha1 Although they are one-way (can not be rolled back), there are several rainbow tables with multiple passwords generated with these hashes.

A technique that could be applied would be the use of salt, which is a concatenation of a text before its password, and then applied the hash, to generate different hashes than those already in the rainbow tables.

Today these techniques are used in the bcrypt