Is using MD5 the safest way to encrypt passwords in PHP?

Question

I know there are several methods of encrypting passwords in PHP (md5, sha1, Base64...) although I don’t know much about, what I see most is the use of MD5.

Using MD5 to encrypt passwords is the safest way? If not, which one to use?

Answer 1

There is a very secure and native PHP solution that is the password API (password API). It is available from version 5.5 natively, but can be used from version 5.3 with a lib available on Github, call Password Compat.

The advantages of using such an API is that it is simple and extremely secure. See the output example for teste with the mechanisms of hash most commonly used (md5 and sha...):

MD5

for ($i = 0; $i < 5; $i++) {
    md5('teste');
}

/* Iterações
    1 - 698dc19d489c4e4db73e28a713eab07b
    2 - 698dc19d489c4e4db73e28a713eab07b
    3 - 698dc19d489c4e4db73e28a713eab07b
    4 - 698dc19d489c4e4db73e28a713eab07b
    5 - 698dc19d489c4e4db73e28a713eab07b

    Resultado: Sempre a mesma string
*/

SHA1

for ($i = 0; $i < 5; $i++) {
    sha1('teste');
}

/* Iterações
    1 - 2e6f9b0d5885b6010f9167787445617f553a735f
    2 - 2e6f9b0d5885b6010f9167787445617f553a735f
    3 - 2e6f9b0d5885b6010f9167787445617f553a735f
    4 - 2e6f9b0d5885b6010f9167787445617f553a735f
    5 - 2e6f9b0d5885b6010f9167787445617f553a735f

    Resultado: Sempre a mesma string
*/

SHA256

for ($i = 0; $i < 5; $i++) {
    hash('sha256', 'teste');
}

/* Iterações
    1 - 46070d4bf934fb0d4b06d9e2c46e346944e322444900a435d7d9a95e6d7435f5
    2 - 46070d4bf934fb0d4b06d9e2c46e346944e322444900a435d7d9a95e6d7435f5
    3 - 46070d4bf934fb0d4b06d9e2c46e346944e322444900a435d7d9a95e6d7435f5
    4 - 46070d4bf934fb0d4b06d9e2c46e346944e322444900a435d7d9a95e6d7435f5
    5 - 46070d4bf934fb0d4b06d9e2c46e346944e322444900a435d7d9a95e6d7435f5

    Resultado: Uma string complexa e grande mas ainda assim sempre a mesma string
*/

PASSWORD API

for ($i = 0; $i < 5; $i++) {
    password_hash('teste', PASSWORD_DEFAULT);
}

/* Iterações
    1 - $2y$10$zRlWkrqyTlEBsCVVf9KOvu3ADTEjOV.TiPHDu8efmgaPCQ75c2V7K
    2 - $2y$10$BydsqC30UGc3QmvalCFTt.pm22fg22195cav.lZOnfSNY9wL5ZcJe
    3 - $2y$10$XHpaG8blIsZCTNPXEubiz.2EyyyZktvydLDu1HtieBkpohN9vswQS
    4 - $2y$10$vNJabya/sj9MZd.DaEwtXuVwqpIwEOcBPN38gOh2gr2wanPwsQVSu
    5 - $2y$10$z3PB5TQHXgml3J0iDMhI8.HrM19Ce77YcI5sYfQQFU3a94.XBzQO.

    Resultado: a cada iteração uma nova hash gerada
*/

For validation the password_verify passing as first parameter the password provided by the user and as according to the hash which is in the database.

$hash1 = '$2y$10$zRlWkrqyTlEBsCVVf9KOvu3ADTEjOV.TiPHDu8efmgaPCQ75c2V7K';
var_dump(password_verify('teste', $hash1));
//true

$hash2 = '$2y$10$BydsqC30UGc3QmvalCFTt.pm22fg22195cav.lZOnfSNY9wL5ZcJe';
var_dump(password_verify('teste', $hash2));
//true

$hash3 = '$2y$10$XHpaG8blIsZCTNPXEubiz.2EyyyZktvydLDu1HtieBkpohN9vswQS';
var_dump(password_verify('teste', $hash3));
//true

$hash4 = '$2y$10$vNJabya/sj9MZd.DaEwtXuVwqpIwEOcBPN38gOh2gr2wanPwsQVSu';
var_dump(password_verify('teste', $hash4));
//true

$hash5 = '$2y$10$z3PB5TQHXgml3J0iDMhI8.HrM19Ce77YcI5sYfQQFU3a94.XBzQO.';
var_dump(password_verify('teste', $hash5));
//true

$hashDesconhecida = '$2y$10$z3PB5TQHXgml3J0iDMhI8.HrM19Ce77YcI5sYfQQFU3a94.X99999';
var_dump(password_verify('teste', $hashDesconhecida));
//false

There are other ways to apply hash in passwords, of course. Many frameworks have their own mechanisms, some quite safe, others a little less but compared to the methods presented here (md5, sha1, hash with sha256 and password API) to password API takes the best without a shadow of a doubt.

If you would like to check out these examples I have passed on: https://3v4l.org/mdFil

Answer 2

The answer is simply nay, MD5 is not the safest and was not near the first placed. :)

Hash != security

The first thing that needs to be demystified is that encryption or hash generation algorithms are not synonymous security, which is something much more comprehensive.

For example, it does no good all the security on the server if the communication with the client occurs by sending passwords to the URL or even if there is no use of HTTPS. Likewise, it is useless to hide the password well and leave the credit card numbers stored in plain text.

Risks of the MD5

It’s really hard to say that the MD5 is absolutely safe or unsafe. But compared to the other algorithms, he’s one of the less secure simply by being faster to calculate and thus making it a little easier to guess the password by brute force.

A article on hashing speed, 2012 contains a speed calculation to hash MD5 of all combinations of passwords using uppercase and lowercase letters, numbers and symbols. Part of the result was:

• 6 characters: 47 seconds
• 7 characters: 1 hour and 14 minutes
• 8 characters: approximately 465 days

Consider that the hardware is outdated and that there are many possibilities to parallelize or simplify this work. Someone with a lot of will, willing to invest a little time and money, could easily decrease these 465 days to a few days or even hours.

Keep in mind even though the time above is the time total, So unless your password is a string of letters "z," it’s probably going to be found first. In addition, simple techniques like leaving the special characters for later can speed up even more. On this website only 17% of users used symbols.

We have to agree that eight-character passwords cannot be guilty of being insecure. In this case, the algorithm is. And this will put most of your customers at risk. Statistics collected by some websites show that most passwords have 8 digits or less.

On top of that, many of the implementations of MD5 use only "raw" lgoritmo, that is, they do not use any kind of "salt", which leaves open the use of hash dictionaries that already have the most common passwords.

Beyond the MD5

Getting back to the point, it may be that MD5 is sufficiently safe and collision-free for a simple case you have today. However, simple hash algorithms are usually not suitable for passwords and there is no reason why you should not use something better.

There are specific solutions to generate password hashes like bcrypt and PBKDF2 that enable you to adjust the level of security you want. They are iterative, that is, apply multiple encryption iterations according to the desired level.

Season the password

The advantage of the algorithms mentioned above is that they reinforce the use of salt (salt), which is very important to decrease the impact of attacks.

Salt must be a unique value per password that causes each of them to be generated in a unique way.

This greatly decreases the efficiency of brute force attacks in the sense that even equal passwords will have a different hash value.

Don’t invent the wheel, PHP is already round

PHP (from the 5.5) has the function password_hash that uses the algorithm bcrypt to encode passwords safely.

The following code, extracted from the documentation, illustrates how you can use the function:

echo password_hash("rasmuslerdorf", PASSWORD_BCRYPT)."\n";

Note that the function already creates a cryptographically safe salt. Do not forget that this value is included along with the hash to make it possible to verify the password later through the function password_verify.

Don’t be lazy, boy

In short, with a function already implementing what is recommended to hash passwords, there is no reason today to continue using something potentially more insecure.

Answer 3

The MD5 is safe, but it is exaggerated to say that it is the best. Therefore, by responding directly, it is not the best. But it doesn’t mean you can’t use and you should change everything where you’re using MD5.

You will probably find recommendations to avoid use as if it were something extremely insecure and easy to circumvent. But what happens is an unnecessary outcry.

Challenge! Let’s prove in practice that MD5 is easy to break?

Let’s see here, a challenge for those who claim MD5 is insecure and easy to discover a combination.

We have this string MD5: bc99449990cd1dedd0b3af807f862fbe

Try to decipher. It is also valid if you can find a collision. Since it is so easy to "break the hash", then it should be an easy challenge. rsrs

This is the hash of the same string in sha1:

6cc0d1e3259b4a7df3b3609207842a08332357b4

Here the same in sha256:

562e5a05b801149cb70092fd1335bb6f40320b44bd7873fb7c05ee1e05f5a606

Of the 3 above, sha256 is obviously safer. If you can use sha256, use it instead of MD5.

The problem is the hash or password?

Note that a weak password of type 12345 is as insecure in MD5 as any other hashes. There is no advantage to using a modern and recommended hash if the system allows weak passwords.

To decipher a hash are used Brute force techniques. The Brute force programs have 2 tables. A table contains obvious words used in passwords like "root", "123", "password", "pass", "admin", etc.

The second table is called "Rainbow table".

The logic is to check if the hash exists in the tables and return the respective string that generated that hash. Simple as that. All known hashes are vulnerable. What will differentiate the level of security is the size of the hash, use of salt, complexity of the original string and collisions.

MD5 has "only" 32 characters. This implies a higher number of collisions. And that is where the biggest problem of MD5 lives.

What are the collisions?

For example, let’s suppose that 1234 manages the hash dfji34iudhfkjfdbn.

The collision occurs when another combination of strings generates the same hash as another combination. Suppose 5%sdi¨¨4dd89 $$Fi9w孤nrrピfe0e90にnf+nbs generate the same hash dfji34iudhfkjfdbn. Ready! We have a collision! Even if you haven’t discovered the original string 1234, ended up going through authentication because it encountered a collision.

(important: the above hash is merely illustrative, with didactic fineness)

There is also the fact that MD5 is generated faster, which makes it "less difficult" to generate combinations. Notice that I prefer to say "less difficult" than to use "easier", because, easy is not.

Note that combinations of all existing characters can take years, decades or centuries depending on the computers you use as it requires a lot of data processing power.

Refer to this old reply as an add-on: /a/96652/4793

Brute force

Okay, now let’s assess the environment. To find a combination for a given hash you need direct access to the data because the method consists of Force, i.e., brute force attempts.

A website, for example, should not allow multiple login attempts in less than 1 second, for example. When it detects something like this, the system must block the login. Therefore, via the web, submitting data by GET, POST, it is impracticable for a hacker to apply Force. Unless the site is very bad and allows such action. At this point is not the fault of the hash used, but of who made the system. In addition there is also the cost of request time and response, making executions slower. Therefore, in the web environment is simply unworkable.

Another point is that you should usually have a combination of username and password. Even if you can figure out a combination of a hash you still have to match the username.

if ( user == 'foo' && pass == MD5('senha') )

Therefore, it is exaggerated the boast they make about the alleged lack of security in the use of MD5 because depends on the context, of ambience, of situation, of circumstance, etc..

Hacker has direct access to database and system

Let’s assume the hacker got direct access to the database and the system. Okay, now he can use Brut force to decode a password. Ok, but think about it. Why would the attacker want to know the password if it’s already inside the system? What’s the point? If you normally want to steal something, the subject will not waste time playing with a password. He goes right where he interests. At this point, with direct access to data, passwords and the authentication system are useless. And even if you still need a password to, for example, access a system where he could not hack, he can modify the email from an account to an email where he has access and so request the password exchange. Bingo!

So where the use of MD5 or a "weak" hash should really be avoided?

A hash considered vulnerable should be avoided in cases such as a digital signature, a public key, among others. Data that is publicly exposed. Because in such cases, the hacker has no job in having to hack into the system. Just grab the hash and search for combinations. SSL uses public and private keys, for example, because it needs a public ID to authenticate with the private key.

Therefore, it is exaggerated and senseless to worry about passwords of a website, within this context that we are addressing. Unless the passwords have a specific use purpose other than to authenticate to access data on this site. For example, if the password provides the access key to a third-party system.

Answer 4

MD5 is not a good option to encrypt passwords for several reasons. It is certainly better than nothing, but it is not a "serious" protection. Some reasons are MD5, others the type of algorithm it is.

1) MD5 is a hash algorithm with several weaknesses, or at least has had several weaknesses discovered. It is not recommended to use MD5 to check the integrity of a document, as there are ways to generate another document with the same MD5 easily.

2) To encrypt password with hash, you must at least use a salt. Otherwise, it is easy to use a "Rainbow table", i.e., a list of precomputated hashes with common passwords. For example, if you search for 455c99907225a26d1a6e3fa2ce99c9c0 in Google, you will find that this is the MD5 of the word 'sux'. That is, if I had used MD5 to encrypt the password 'sux', it would be trivial to discover the original password!

salt or spice is added to the original password before calculating the hash, so that the hash is different for each user and password. For example, the 'saltsux' MD5 is 5b599ee9dbeb7d6469fa9c300cad07cc, that you no longer find by doing a simple Google search, and even if an attacker knew that salt is equal to 'salt', it does not help much when calculating the hash. Obviously, salt should be random and different for each user, using a fixed and short salt was just a silly example.

3) Hash algorithms in general (MD5, SHA1, SHA2, SHA256, etc.) are designed to run as fast as possible. This makes another form of attack possible: calculating the hash of numerous words (with 'salt') to try to find the hash that matches your system - and thus discover the password.

To avoid this problem, one should use specific hashes to encrypt passwords, such as bcrypt, which consumes a lot of CPU and time to calculate the hash. An opponent who wants to try several hashes would waste a huge amount of time calculating each possible hash.

Bitcoin uses a curious scheme to consume a lot of CPU in the hash calculation. It uses SHA-256, which is very fast, but the hash must have a number of zeros (bits 0) at the beginning. The number of zeroes is calibrated so that the hash takes an average of 10 minutes to find. This is a strategy that could also be used to, from a fast hash algorithm, create a 'slow' hash algorithm, which would serve as passwords.

Answer 5

Very well put the answer of @daniel-Omine.

I agree that the md5 is not so insecure, no use having a super-secure login system, which blocks multiple login attempts, etc if we have you user. I’ve read somewhere (and I agree) that the most insecure part of a system is users. Hardly in a system will not have a user even who will use a rough password, commonly used, and use that same password to log in the email registered in the system and the rest is easy to predict. I do not recommend md5 since there are better alternatives like the password_hash.

I know that many do not care about this problem that will always exist in systems that do not foresee weak passwords, but hinder the work of possible invaders, it is a good start.

Answer 6

Never use hash Pure MD5 to encrypt passwords and save them in database. Because it is a very fast calculation algorithm, it makes a brute force attack easy.

http://blog.thiagobelem.net/encriptando-senhas-de-forma-segura

Answer 7

MD5

md5 generates an alpha-numeric string of 32 characters, no matter if you are generating the md5 of two letters or a text of 20 paragraphs... The generated md5 will always have 32 characters.

SHA1

The other one-way hash is sha1. It is practically identical to md5, but has 160 bits, which ends up creating a larger string-result: 40 alpha-numeric characters. Another point of sha1 is that, because it is 160 bits and generates a larger string, a collision (find two strings that, encoded, are the same thing) is much rarer than a 128bit key.

http://blog.thiagobelem.net/criptografia-no-php-usando-md5-sha1-e-base64