Re: [PHP-DEV] SHA-1 support
On Sun, Feb 17, 2002 at 04:23:24PM +0100, André Næss wrote : I can't seem to find support for the SHA-1 algorithm in PHP. I did find the mhash() function, but not only is this function very badly documented (no list of what hashes it supports!), [...] http://www.php.net/manual/en/ref.mhash.php Here is a list of hashes which are currently supported by mhash. (with a list including SHA1). It also states it's possible this documentation is outdated (which I didn't verify). SHA1 is as easy as writing: $sha1 = mhash(MHASH_SHA1, yoursecretdata); And I never used it before or any mhash() function so it's not really hard to achive this. mhash is available for nearly every distribution as a package and even if not, it's not hard to install. I can see a possible point with a dedicated sha1() function, but I don't see one in saying that mhash() is badly documented (even if it was, it's very easy to find the right information within seconds). The later case would vindicate a documentation report. - Markus -- Please always Cc to me when replying to me on the lists. GnuPG Key: http://guru.josefine.at/~mfischer/C2272BD0.asc -- PHP Development Mailing List http://www.php.net/ To unsubscribe, visit: http://www.php.net/unsub.php
Re: [PHP-DEV] SHA-1 support
Markus Fischer [EMAIL PROTECTED] wrote in message [EMAIL PROTECTED]">news:[EMAIL PROTECTED]... I can see a possible point with a dedicated sha1() function, but I don't see one in saying that mhash() is badly documented (even if it was, it's very easy to find the right information within seconds). The later case would vindicate a documentation report. Hm. My bad, I seem to have read only the entry on mhash() after ending up there through a search. A reference to Mhash from crc32() and md5() would be nice though, just to tell people about other hashing functions. Maybe there should also be a mention of the fact that MD5 is fairly easy to crack? Anyway, the reason why I want a dedicated SHA-1 function is that it's stronger than MD5, and that (as far as I can see) it is now the recommended hashing function, having to install some extra stuff for this purpose seems wrong to me. Regards André Næss -- PHP Development Mailing List http://www.php.net/ To unsubscribe, visit: http://www.php.net/unsub.php
Re: [PHP-DEV] SHA-1 support
In [EMAIL PROTECTED], André NæSs wrote: Markus Fischer [EMAIL PROTECTED] wrote in message [EMAIL PROTECTED]">news:[EMAIL PROTECTED]... I can see a possible point with a dedicated sha1() function, but I don't see one in saying that mhash() is badly documented (even if it was, it's very easy to find the right information within seconds). The later case would vindicate a documentation report. Hm. My bad, I seem to have read only the entry on mhash() after ending up there through a search. A reference to Mhash from crc32() and md5() would be nice though, just to tell people about other hashing functions. Maybe there should also be a mention of the fact that MD5 is fairly easy to crack? Who said that? Never heard of any claims, that md5 is insecure ... chregu -- PHP Development Mailing List http://www.php.net/ To unsubscribe, visit: http://www.php.net/unsub.php
Re: [PHP-DEV] SHA-1 support
On 2002-02-17 17:35:26, André Næss wrote: nice though, just to tell people about other hashing functions. Maybe there should also be a mention of the fact that MD5 is fairly easy to crack? Can you give some references? Yes, MD5 does have some weaknesses (so SHA1 would probably be better), but as far as I know it's not fairly easy to crack. (I must search the Dobbertin paper, which probably found the first serious design flaws in MD4, but IMHO no real attacks in practice until now for MD5. Are there any newer papers about this?) Stefan -- Stefan Röhrich [EMAIL PROTECTED], [EMAIL PROTECTED] http://www.roehri.ch/~sr/ -- PHP Development Mailing List http://www.php.net/ To unsubscribe, visit: http://www.php.net/unsub.php
Re: [PHP-DEV] SHA-1 support
Christian Stocker [EMAIL PROTECTED] wrote in message [EMAIL PROTECTED]">news:[EMAIL PROTECTED]... Who said that? Never heard of any claims, that md5 is insecure ... http://mdcrack.multimania.com/index2.html André Næss -- PHP Development Mailing List http://www.php.net/ To unsubscribe, visit: http://www.php.net/unsub.php
Re: [PHP-DEV] SHA-1 support
Stefan Roehrich [EMAIL PROTECTED] wrote in message [EMAIL PROTECTED]">news:[EMAIL PROTECTED]... On 2002-02-17 17:35:26, André Næss wrote: nice though, just to tell people about other hashing functions. Maybe there should also be a mention of the fact that MD5 is fairly easy to crack? Can you give some references? Yes, MD5 does have some weaknesses (so SHA1 would probably be better), but as far as I know it's not fairly easy to crack. (I must search the Dobbertin paper, which probably found the first serious design flaws in MD4, but IMHO no real attacks in practice until now for MD5. Are there any newer papers about this?) I just read some general discussions on the topic in misc. security related boards and got the impression that the consensus was that MD5 should be phased out and replaced by SHA-1. Also have a look at the URL in my reply to Christian Stockner. It is my impression that SHA-1 can't be easily cracked using brute-force, which is viable with MD5, and thus MD5 should be replaced by SHA-1. I might of course have misunderstood as this is not my field of expertise. André Næss -- PHP Development Mailing List http://www.php.net/ To unsubscribe, visit: http://www.php.net/unsub.php
Re: [PHP-DEV] SHA-1 support
On 2002-02-17 19:31:40, André Næss wrote: I just read some general discussions on the topic in misc. security related boards and got the impression that the consensus was that MD5 should be phased out and replaced by SHA-1. That may be true for some new applications (where you can use mhash). But PHP needs MD5, because it's used in various applications, so PHP has to cooperate. Also have a look at the URL in my reply to Christian Stockner. It is my impression that SHA-1 can't be easily cracked using brute-force, which is viable with MD5, and thus MD5 should be replaced by SHA-1. That's a simple brute force attack (using the well known birthday attack which is appliable for nearly every hash like function). And as they write on their web page: The problem is not at all in the MD5 algorithm in itself but in the manner application are using it. MD5 was not defined for authentication purpose and give no real security against data compromision. So it's not a flaw in the MD5 algorithm itself (yes, today it should probably support bigger hashes, there are already variants of SHA1, which have longer hashes), but rather in using MD5 for small guessable things like passwords without any salt or similar. Today you probably should go to longer key and hash sizes, but I think MD5 is still a lot better than old unix crypt. Stefan -- Stefan Röhrich [EMAIL PROTECTED], [EMAIL PROTECTED] http://www.roehri.ch/~sr/ -- PHP Development Mailing List http://www.php.net/ To unsubscribe, visit: http://www.php.net/unsub.php
