crypt

// this replaces $cryptString =
crypt($plainString, $salt);

$command = "perl -e \"print crypt('$plainString', '$salt');\"";

$cryptString = exec($command);

function gensalt(){

function rannum(){

mt_srand((double)microtime()*1000000);

$num = mt_rand(46,122);

return $num;

}

function genchr(){

do{

$num = rannum();

} while ( ( $num > 57 && $num < 65 ) || ( $num > 90 && $num < 97 ) );

$char = chr($num);

return $char;

}

$a = genchr();

$b = genchr();

$salt = "$a$b";

return $salt;

}
$result = gensalt();

echo $result";

First the decrypt() function:

string decrypt(string data, integer method, string key)

The decrypt() function attempts to transform an encrypted string passed as the data argument into plain text using the method specified by the method argument and the key from the key argument. Each of the four methods uses a single key that both encrypts and decrypts. The methods are listed below:

METHOD: NAME: MINIMUM DATA LENGTH: REQUIRED KEY SIZE:

0 IDEA 8 characters 16 characters

1 MDC 8 characters 8 characters

2 DES 32 characters 16 characters

3 XOR 16 characters 16 characters

Then the encrypt() function:

string encrypt(string data, integer method, string key)

To encrypt the data you wish to later decrypt, use the encrypt() function. Data are encrypted using one of four methods and a key. See the description of the decrypt() function for more information.

Example:

$message = "this is a plain text message";

$password = "secret";

$data = encrypt($message, 0, $password);

print(decrypt($data, 0, $password));

Once again (I've been getting some e-mails on this subject): the crypt() function is a one-way-algorithm - There is no way to decrypt the information crypted with crypt(). If you want to crypt something that shall later be decrypted, you can use the encrypt() and decrypt() function (as I've discussed above, but the two functions are not enabled by default in PHP3 - See further down on how to do this).

While working with PHP and crypting I've also discovered another function: "md5()". This function does the same as crypt(), but while crypt() doesn't work on a windows platform (as far as I know) the md5() does. The md5() is by far more secure than crypt() as crypt() only looks at the 1st 8 chars.

To find out how the two functions encrypt() and decrypt() works, I contacted Leon Atkinson, author of "Core
PHP Programming". Here is what he wrote:


--------------------------------


There's two problems. First, you need to enable the php3_crypt.dll to make the functions available. You can do that either by uncommenting the line:

extension=php3_crypt.dll

in your php3.ini file, or you can use dl(), such as:

dl("extension=php3_crypt.dll");

First, the encrypt() and decrypt() functions talked about earlier use symmetric encryption; that is, the same key that encrypts also decrypts. So, if your key (the third argument to both functions) isn't kept completely private, you may as well have sent plaintext.

Second, MD5 is not really encryption. It is a cryptographic hash function. It is not used to encrypt data really. It is used to test whether a message has been altered during transit. It is "cryptographically secure" because if I send you an encrypted message with the plaintext's MD5 hash value, and a middle-man alters the encrypted message (but can't recalculate the MD5 hash value of the message, b/c it's encrypted), the MD5 hash of the plaintext that you compute will differ from mine. Then you'll know that somebody altered it. It's not used for encryption because it's a many-to-one hash function. Many, many plaintexts will map to one MD5 value. Valid encryption does not work this way. MD5 is also a one-way function, meaning that you cannot (without much difficulty) reproduce the same plaintext with its MD5 hash value.

You can use crypt (for passwords), md5() for a cryptographic hash function, and encrypt()/decrypt() in conjunction for some really good security on your website (but don't forget that unless you use SSL or some other encryption on the client-side that everything's being sent in plaintext).

What I would suggest to the creators of PHP is to write functions that use public cryptography -- algorithms like RSA -- so that we have more options. Implementing some sort of Kerberos-type authentication might work with cookies, also.

_Cryptography and Network Security_ by William Stallings is a good book on this stuff.

Ah, I remembered something VERY important!!!

NEVER, EVER, EVER use a simple XOR to encrypt data (except, MAYBE with a one-time pad in certain circumstances). If I have plaintext <code>x</code> and I <code>XOR</code> it with <code>y</code>, like so: <code>x XOR y = z</code>, then you know what? If some malicious guy, Mark, knows the plaintext, he can just do this: <code>z XOR x = y</code>. Now Mark knows your key. If he knows the key, he can get your plaintext: <code>y + z = x</code>.

Now, with symmetric ciphers like DES and Blowfish, if somebody knows your key, they can decrypt your data or encrypt it and pose as you. But it would be really difficult for someone to get your key if they knew the plaintext and the ciphertext. With XOR, somebody can get your key with the plaintext. NOT GOOD . . . perhaps unless it's a one-time pad (i.e., the key is as long as the plaintext (you don't have to repeat it), it's REALLY random, and you never use it again).

I'm not sure if the PHP encrypt uses a plain XOR cipher (in XOR mode), but it would be horrible if it did.

Just so you know.

There is no reason MD5 cannot be used as a hash function for password protection.

MD5, like all hash functions, is designed to minimise the possibility of collisions. A hash function would not be very secure if it did not do this.

Quoting from the MD5 RFC (refer to http://www.normos.org/ietf/rfc/rfc1321.txt)
"It is conjectured that the difficulty of coming up with two messages having the same message digest is on the order of 2^64 operations, and that the difficulty of coming up with any message having a given message digest is on the order of 2^128 operations."

Those people recommending XOR to encrypt sensitive information should look at any security book before doing such a silly thing.

/* you found this at php.net under crypt forum */

/* your db search goes here.... select * from where id = '$user' */



$mysql_pass = urlencode(crypt(mysql_result($result,0,"pass"),32));



if ($mysql_pass == $encrypted_pass){
$logged = 1;

}

It seems that a lot of people don't understand the point of using one-way encryption. More importantly, a lot of web designers forget that PHP encryption is done entirely on the web server, not the client.

Point being, if your form has a password input option and the user clicks SUBMIT, the password is then sent _as plain text_ over the Internet to the web server where it is then encrypted for comparison against a password database.

Do _not_ use these types of functions to add security to a form unless you're using an SSL or TLS (etc.) encrypted session. The only potential way around this issue is for you to write a JavaScript program that does the hashing on the client side before being sent over the Internet (which would make this function unnecessary).

Remember: SSL!