Question

i just get one function from this site which describe that how to generate secure password using hash.
function is bellow

function hash_password($password, $nonce) {
  global $site_key;
  return hash_hmac('sha512', $password . $nonce, $site_key);
}

i am using this function like

$salt = sha1(rand()); 
$salt = substr($salt, 0, 4); 
$site_key="site.com";
$pass=hash_password($pass,$salt);

it generate random text on each time.
but i am unable to verify that password in database, as in database password is stored and this generate random text every time.

i want to know how can i use this function to

1. Store Password in Database at time of user creation
2. Verify Password from database at login

or

is there any other secure way?

Thanks

Answer 1

You need to store the random string ($nonce I presume) in your database as part of the data, together with the resulting hash. Otherwise, you simply don’t have enough information to validate the password.