Diese Seite bei php.net
The PHP manual text and comments are covered by the Creative Commons Attribution 3.0 License © the PHP Documentation Group - Impressum - mail("TO:Reinhard Neidl",...)
SSL/SSH schützt zwar die gerade auf dem Weg befindlichen Daten vom Client zum Server, jedoch nicht die dauernd in einer Datenbank gespeicherten Daten. SSL ist ein "auf-der-Leitung" Protokoll.
Hat ein Angreifer direkten Zugriff auf Ihre Datenbank (den Webserver umgehend), können die gespeicherten heiklen Daten aufgedeckt oder zweckentfremdet werden, außer wenn die Information von der Datenbank selbst geschützt ist. Die Daten zu verschlüsseln ist ein guter Weg, diese Gefahr zu mildern, doch bieten nur wenige Datenbanken diese Art der Verschlüsselung von Daten.
Der einfachste Weg, dieses Problem zu umgehen ist, erst einmal Ihr eigenes Verschlüsselungspaket zu erstellen, und dieses dann in Ihren PHP Skripten zu nutzen. PHP kann Ihnen in diesem Fall mit seinen verschiedenen Erweiterungen helfen, wie z.B. Mcrypt and Mhash, welche eine große Auswahl an Verschlüsselungsalgorhythmen abdecken. Das Skript verschlüsselt die Daten vor dem Speichern, und entschlüsselt diese wieder beim Erhalt. Siehe die Verweise für weitere Beispiele, wie Verschlüsselung arbeitet.
Im Fall von wirklich versteckten Daten, wenn deren unverfälschte Repräsentation nicht nötig ist (z.B. keine Anzeige), ist hashing ebenfalls überlegenswert. Das bekannte Beispiel für das Hashing ist das Speichern des MD5 hash eines Passwortes in einer Datenbank, anstatt des Passwortes selbst. Siehe auch crypt() und md5().
Beispiel #1 Verwenden eines hashed Passwortfeldes
// Speichern des Passwort hash
$query = sprintf("INSERT INTO users(name,pwd) VALUES('%s','%s');",
pg_escape_string($username), md5($password));
$result = pg_query($connection, $query);
// Afragen, ob der User das richtige Passwort übermittelt hat
$query = sprintf("SELECT 1 FROM users WHERE name='%s' AND pwd='%s';",
pg_escape_string($username), md5($password));
$result = pg_query($connection, $query);
if (pg_num_rows($result) > 0) {
echo "Welcome, $username!";
} else {
echo "Authentication failed for $username.";
}
I'm using this function to hash my passwords. The important aspect of it is that the salt is longer then the password hash, this creates collisions which is the only complete protection against brute-force attacks. This script creates 16 collisions for every iteration. Also, the salt is stored as the first 88 characters of the hash which makes it accessible for validation. Hash total length is 128 hex.
The hash will never be the same but is still possible to validate. Wow!
<?php
/**
* Created by Gustav Svalander 2009
* Hash string using a salt, if no salt is specified it is
* randomly generated.
* @param String Information to be hashed.
* @param String Hashing salt.
* @return String One string beginning with the salt then the hash
*/
function xerHash($information,$salt=null){
$result = utf8_encode($information);
if($salt == null)
for($i=0;$i<88;$i++)
$salt.=dechex(rand(0,15));
for($i=0;$i<3000;$i++){
$result = sha1($salt.$result);
}
return ($salt.$result);
}
//Test
$hash = superHash("test");
$validation = superHash("test",substr($hash,0,88));
echo 'Hashing:"test"<br>Hash:'.$hash.'<br>Hash validation:'.$validation;
?>
MD5/SHA1 is not safe for strings shorter then 10 characters. Especially if you don't use a strong combination.
Cracking this hash would result in having 4,3046721e+55 possible passwords.
In addition to roysimkes at hotmail dot com:
If your passwords are so secret that they're worth a year's hacking/cracking/etc, you might want to consider 'password renewal', much like Windows' option. Tell your users to renew their passwords every x days/weeks/months to make it extra hard on those already-sweating malicious visitors.
A better way to hash would be to use a separate salt for each user. Changing the salt upon each password update will ensure the hashes do not become stale.
You should always hash the password with the username, so store md5($password . $username) instead of md5($password) This way the cracker cannot use a precomputed set of hashes of common keys, but has to recompute the hashes for each user.
Double hashing also can help in some situations as it solves length extension problems with all hash functions. Also you should use SHA-256, as it has a longer hash length and thus it takes 2^128 steps to find a collision
I think the best way to have a salt is not to randomly generate one or store a fixed one. Often more than just a password is saved, so use the extra data. Use things like the username, signup date, user ID, anything which is saved in the same table. That way you save on space used by not storing the salt for each user.
Although your method can always be broken if the hacker gets access to your database AND your file, you can make it more difficult. Use different user data depending on random things, the code doesn't need to make sense, just produce the same result each time. For example:
if ((asc(username character 5) > asc(username character 2))
{
if (month the account created > 6)
salt = ddmmyyyy of account created date
else
salt = yyyyddmm of account created date
}
else
{
if (day of account created > 15)
salt = user id * asc(username character 3)
else
salt = user id + asc(username character 1) + asc(username character 4)
}
This wont prevent them from reading passwords when they have both database and file access, but it will confuse them and slow them up without much more processing power required to create a random salt
Diese Seite bei php.net