Secure Hashing Approved Algorithms – How do I perform SHA-2 family hashing in my PHP application?
- How do I perform SHA-2 family hashing in my PHP application?
- How to use SHA-2 (One-Way Hash Function) to hash passwords in readable format?
- The MD4, MD5 using PLSQL hashing algorithms
- Oracle 11g new password algorithm is revealed by seclists.org !
- Oracle Password security algorithm and the default passwords
There are five Approved algorithms for generating a condensed representation of a message (message digest): SHA-1, SHA-224, SHA-256, SHA-384, and SHA-512.
The SHA-2 family of hash functions (i.e., SHA-224, SHA-256, SHA-384 and SHA-512) may be used by Federal agencies for all applications using secure hash algorithms. Federal agencies should stop using SHA-1 for digital signatures, digital time stamping and other applications that require collision resistance as soon as practical, and must use the SHA-2 family of hash functions for these applications after 2010. After 2010, Federal agencies may use SHA-1 only for the following applications: hash-based message authentication codes (HMACs); key derivation functions (KDFs); and random number generators (RNGs).
With PHP >= 5.1.2, You can use hash() to generate a hash value, hash_algos() will return an array of supported hashing algorithms. See:Upgrade to PHP >= 5.1.2. You can use hash() to generate a hash value, hash_algos() will return an array of supported hashing algorithms. Following code produces hash results.
SHA-1 was compromised by a research team in China and it’s use has been discontinued by the U.S Government in favor of the SHA-2 family of hashing algorithms.
syntax:
string hash ( string $algo , string $data [, bool $raw_output= false ] )
echo hash(‘md5′, ‘The quick brown fox jumped over the lazy dog.’) . "<br>\n";
echo hash(’sha1′, ‘The quick brown fox jumped over the lazy dog.’) . "<br>\n";
echo hash(’sha256′, ‘The quick brown fox jumped over the lazy dog.’) . "<br>\n";
echo hash(’sha384′, ‘The quick brown fox jumped over the lazy dog.’) . "<br>\n";
echo hash(’sha512′, ‘The quick brown fox jumped over the lazy dog.’) . "<br>\n";
?>
5c6ffbdd40d9556b73a21e63c3e0e904
c0854fb9fb03c41cce3802cb0d220529e6eef94e
68b1282b91de2c054c36629cb8dd447f12f096d3e3c587978dc2248444633483
b7273c05ad141ccb6696b3659e57137c453b6d64690fa7d5cf96368df4a7138703a8c6ead31727b487b3628746510391
0a8c150176c2ba391d7f1670ef4955cd99d3c3ec8cf06198cec30d436f2ac0c9b64229b5a54bdbd5563160503ce992a74be528761da9d0c48b7c74627302eb25
Ref:
http://csrc.nist.gov/groups/ST/toolkit/secure_hashing.html
http://www.schneier.com/blog/archives/2005/02/sha1_broken.html
If you have a crappy webhost that hasn’t yet upgraded to PHP 5.1 (even though 5.3 is now out), you may want to use phpseclib’s pure-PHP SHA512 implementation:
http://phpseclib.cvs.sourceforge.net/viewvc/*checkout*/phpseclib/phpseclib/Crypt/Hash.php