Question

Before I knew better, I implemented a login system with md5 as the hashing algorithm. Now that I do know better, I’d like to move to using PHPass. My problem is that the system is already in production and asking all users to change their passwords would be the mother of all headaches.

I’ve come up with a simple enough solution, but given my previous mistake I’d like to make sure I’m not making an equally grievous mistake due to ignorance.

My solution is as follows:

Change

1. md5($_POST['pass'])
2. check md5 hashed password against database value

To

1. md5($_POST['pass'])
2. pass md5 hashed password to $hasher->HashPassword()
3. use $hasher->CheckPassword() to check the re-hashed password against value from DB

Just for clarity, I’m only re-hashing the md5 version because that’s what I already have in the DB. It’s not intended as an added security measure (although if it is, that’s great!).

Answer 1

1. MD5() problem is WAY exaggerated on this enthusiast programmers community site. Nothing actually bad in this hashing algorithm, especially in comparison with other parts of usual newbie application. Using phpass techniques on a usual PHP site is like using a safe lock on a paper door of a straw hut.

2. Most important thing in keeping passwords safe against virtual possibility of being stolen and used against the same user on other sites (oh, my!) is password strength and salt. Not hashing algorithm itself. No hashing technique would protect silly pass like “1234” or “joe”.
   So, md5 + strong password + average salt is better than usual password + phpass

3. There is not a ingle reason to phpass existing md5 hash
   A sensible migration algorithm is

   • check this user record for the new hashing flag.
   • if it’s set –
     • go for phpass auth
   • if not:
     • md5($_POST[‘pass’])
     • check md5 hashed password against database value
     • if correct:
       • phpass($_POST[‘pass’])
       • save result in the database
       • set new hashing flag for this record
   • done