To encrypt or not to encrypt...

PHP programming forum. Ask questions or help people concerning PHP code. Don't understand a function? Need help implementing a class? Don't understand a class? Here is where to ask. Remember to do your homework!

Moderator: General Moderators

User avatar
nielsene
DevNet Resident
Posts: 1834
Joined: Fri Aug 16, 2002 8:57 am
Location: Watertown, MA

Post by nielsene »

Jay wrote:
m3rajk wrote:md5 hashing masks it so it looks like gibberish. if they don't know that you're using md5 they can't change anything and come up with something.

md5 is one-way


mcrypt is two way. they can hack and find you encryption/decryption keys
I don't understand your logic, if you've been hacked, your encryption keys are not the only things compromised. I would guess everything else is too...
I beleive he is using "hack" in the sense that an attacker can run a brute force decryption attack on the encrypted value when a two-way algorithm is used, by looping over al possible keys. He is not talking about a case where the server was compromised.

When using a one-way hash w/ secret, the attacker must two a two-dimensional search over possible plaintexts and possible server secrets, which makes the brute force attack harder.

However m3rajk is slightly incorrect. The mcrypt library offers both one-way and two-way functions, for instance the SHA1 hash is availible through mcrypt.
Jay
Forum Newbie
Posts: 22
Joined: Fri Jul 12, 2002 8:36 am
Location: KUL, Malaysia

Post by Jay »

I am not claiming to know a lot about the mcrypt libraries and functions since I have just started learning and experimenting with them recently but with the variety of ciphers and hashed keys combinations I can use, wouldn't it be also as 'secure' if not better then simply comparing a hash?
User avatar
nielsene
DevNet Resident
Posts: 1834
Joined: Fri Aug 16, 2002 8:57 am
Location: Watertown, MA

Post by nielsene »

Security is built out of using a combination of "primitives", each designed for a certain purpose. Sometimes a hash (or a Message Authentication Code built on a hash) is all you need. In the case here, all we need is a strong MAC, which can be produced with either MD5 or SHA1.

Increase options in terms of ciphers does not add real security unless you 1) use them when appropriate and 2) configure them correctly. Both of which can be tough in the mcrypt library.

There are times when security is gained because you now the algorithm is NOT reversible, such times you need a hash.
Jay
Forum Newbie
Posts: 22
Joined: Fri Jul 12, 2002 8:36 am
Location: KUL, Malaysia

Post by Jay »

It seems that we have veered off course here. I wasn't saying anytime in my posts that a one way hash such as md5() was any way less or more insecure in this context.

I was just clarifying since one of the previous posters gave me the impression in his post that it was infact less secure to use the functions off the mcrypt libraries if that is what one chooses to do over anything else.

But I must add here, if I may, that I find these mcrypt functions truly fascinating. I would recommend learning about it to anyone... :)
User avatar
nielsene
DevNet Resident
Posts: 1834
Joined: Fri Aug 16, 2002 8:57 am
Location: Watertown, MA

Post by nielsene »

Jay wrote:It seems that we have veered off course here. I wasn't saying anytime in my posts that a one way hash such as md5() was any way less or more insecure in this context.

I was just clarifying since one of the previous posters gave me the impression in his post that it was infact less secure to use the functions off the mcrypt libraries if that is what one chooses to do over anything else.

But I must add here, if I may, that I find these mcrypt functions truly fascinating. I would recommend learning about it to anyone... :)
Ahh, sorry. I agree then.
m3rajk
DevNet Resident
Posts: 1191
Joined: Mon Jun 02, 2003 3:37 pm

Post by m3rajk »

sorrya bout partaking in the veering. i would like to comment that neilsene was right about what i meant, and also that there are several ways using 2-way keys to avoid brute force and still break the codes (that was something taught in the Brandeis crypto course when talking about security.. i also remember the prof telling us if we're seriously interested we should consider that course nothing more than a primer and do an independant study, or take summer courses at MIT since it's "probably the best place to learn about cryptology" i was unable to fit it in so i only got the first few classes. unfortunately. but it's what he said about MIT that makes me feel that neilsene is easily one of the best sources here when it comest to that area since he's obviously interested in security
User avatar
nielsene
DevNet Resident
Posts: 1834
Joined: Fri Aug 16, 2002 8:57 am
Location: Watertown, MA

Post by nielsene »

FWIW, Stoker is even more knowledgeable it seems, especially with regards to practicality of different methods in shared hosting environments. I just know the theory, and dabble in using it. And I have dedicated hosts with only two local users :)
User avatar
wmasterj
Forum Commoner
Posts: 40
Joined: Mon Aug 18, 2003 5:52 pm
Location: Stockholm, Sweden

Post by wmasterj »

Man this topic was helpfull for me guys!

Thx... :)
Post Reply