Search code examples
phpcrypt

Is it secure for the string and salt to be the same with crypt() in a password?


As in, say someone gets access to the hash "PafgokWMoHSZE". Because this has been obtained through crypt(Password1,Password1) would it be any easier/harder to reverse engineer than any other salt?


Solution

  • I would say it is not very safe simply because anyone can try the password itself as a salt.

    A cracker can easily make it a rule to always try the password itself as a salt. Or even not systematically but only on a test batch. If your salt-encrypted password are leaked he can try that with a first run and then discover that the password is the salt very easily, then apply the same recipe for the rest of the list.

    More explanation

    If your password is "flower", any dictionary attack will try the word "flower". The cracker will try and lookup the hashes of "flower" in md5, SHA1, etc. If it doesn't work then he will assume the hash has been salted. That makes things much harder. Unless he tries to use the password itself as a salt.

    Read this and be scared: http://arstechnica.com/security/2013/10/how-the-bible-and-youtube-are-fueling-the-next-frontier-of-password-cracking/