Gossamer Forum: General: Internet Technologies: PHP crypt()

Jun 5, 2002, 9:26 AM

Andy

Veteran / Moderator (18441 posts)

Jun 5, 2002, 9:26 AM

Post #1 of 10

Shortcut

PHP crypt()

Mmm..this is weird!

Using this;

Code:
<?php 

$word = "dfsmething@sfdfgdfgfsf.com.ufk"; 
$code = crypt("MM", $word); 

echo $code; 

?>

Returns;

dfaVtLshRfT5E

And changing;

$word = "dfsmething@sfdfgdfgfsf.com.ufk";

to

$word = "dfsmething@sfdfgdfgfsf.com.uk";

(not the ufk is changed to uk) gives me;

dfaVtLshRfT5E

Why?

Shouldn't they be different, as they are different words? Does the crypt() function only generate up to 13 char encrypted words?

Thanks

Andy (mod)
andy@ultranerds.co.uk

Jun 5, 2002, 9:28 AM

Paul

Veteran (19537 posts)

Jun 5, 2002, 9:28 AM

Post #2 of 10

Shortcut

Re: [Andy] PHP crypt() In reply to

MD5-based crypt() uses an 8-character salt.

Jun 5, 2002, 9:31 AM

Andy

Veteran / Moderator (18441 posts)

Jun 5, 2002, 9:31 AM

Post #3 of 10

Shortcut

Re: [Paul] PHP crypt() In reply to

Ah..I see. All I need it for is to create a random password for people signing up to my site. I'm going to use their username to create a random password with either MM, or another random salt. Now I gott work out what I'm gonna use for the username :p

Thanks

Andy (mod)
andy@ultranerds.co.uk

Jun 5, 2002, 10:16 AM

Alex

Administrator (9387 posts)

Jun 5, 2002, 10:16 AM

Post #4 of 10

Shortcut

Re: [Andy] PHP crypt() In reply to

The crypt() function is DES based and only works off the first 8 chars of a password:

[alex@penguin ghost]$ perl -le 'print crypt("12345678", "aa")'
aaNN3X.PL2piw
[alex@penguin ghost]$ perl -le 'print crypt("123456789", "aa")'
aaNN3X.PL2piw
[alex@penguin ghost]$

If you are looking for more secure password encryptions, try using an md5 based encryption. It's Digest::MD5 in Perl, not sure what it would be in php. =)

Cheers,

Alex
--
Gossamer Threads Inc.

Jun 5, 2002, 10:18 AM

Alex

Administrator (9387 posts)

Jun 5, 2002, 10:18 AM

Post #5 of 10

Shortcut

Re: [Andy] PHP crypt() In reply to

Oh, also, you've got your arguments backwards I think:

$code = crypt("MM", $word);

should probably be:

$code = crypt($word, "MM");

where "MM" is a randomly generated salt string. I think PHP provides this for you if you don't specify it, so:

$code = crypt($word);

should be fine.

Cheers,

Alex
--
Gossamer Threads Inc.

Jun 5, 2002, 10:18 AM

Andy

Veteran / Moderator (18441 posts)

Jun 5, 2002, 10:18 AM

Post #6 of 10

Shortcut

Re: [Alex] PHP crypt() In reply to

Ah..I see. I was only really looking at using the email address as a wqay to make a random looking password (rather than using rand() with a sdpecific selection of chars...)

Thanks Smile