Question

I am rewriting a PHP Login system and I just faced this

function createSalt()
{
    $string = md5(uniqid(rand(), true));
    return substr($string, 0, 3);
}
$salt = createSalt();
$hash = hash('sha256', $salt . $hash);

Actualy I never worked with salting before, I searched a bit and found it useful.
But my answer is, Is this a good way to work with salt?
Wouldn’t $string = sha1(uniqid(mt_rand(), true)) be better?

And what about returning only 3 characters of the hash? I really don’t get it.

What you think?

Answer 1

I prefer sha1 or sha256, md5 is super-outdated, the sha-functions are way better. But this is my opinion, choose what you want.

What is really important in this case is the salt. A salt is always stored in plaintext together with the hash and is used to improve the length of a password (if you want to hash the password, might be something else of course) to prevent attacks based on rainbow/lookup tables. This is no protection against cracking the password by using bruteforce (which works quite well against md5, so use sha256 which is harder to crack).

Therefore it is totally unimportant if you use 32 random chars for the hash, or something like md5(mt_rand()) – important is the length. I would use something like

$hash = md5(mt_rand()) . md5(mt_rand());

md5() results in 32 bytes string, based on a random number (mt_rand() is better then uniqueid()). With this simpel line you get a very “strong” hash which should secure every password against rainbow tables.