Just a question, what does sha1 offer that md5() does not? and why should i use it over any other function?

__________________

---

Sure. I'll be happy to elaborate. Undoubtedly you know that a hash is a one-way function (i.e. no inverse is known to exist). This makes finding people's passwords out pretty much impossible. So, how to hack it? Well, hash functions do have the ability to have 2 different inputs return the same value (don't ask me for an example, lol.) A hash is considered compromised if someone develops a way to "relatively" quickly find an input which comes up with the same output as for your actual password. This new input can be used for your password without ever having to know the original password. The post on php.net I linked to indicates that sha1 (which is newer than md5) has been compromised in such a fashion (md5 was a few years back if memory serves). To ensure that such an attack does not work on your system (essentially leaving it only open dictionary and social engineering attacks), you'll want to use one of the latest hashing functions that have not yet had such a method developed.

__________________
Jeremy Miller
Content Farmer - Optimized Automated Blog Posting

---

I will use that from now then , thanks

__________________

---

OP - Apologies for continuing this thread going way off topic

Jeremy - Aren't the crack methods for SHA1 and MD5 just going through combinations of characters hoping for a string that has the same hash as the actual password? In that case, isn't SHA1 more secure because it simply has a longer hash and would be less likely to have two strings match?

__________________
- Ryan

---

Yes, but generally in some kind of optimized way to reduce the amount of work required.
SHA1 is more secure than MD5 and a careful reading of my previous post will show that I implied that. Using the same logic SHA256 is more secure than SHA1 and SHA512 is more secure than those others. Hence my recommendation for using those more secure methods.

I think you may have just gotten confused about what I was saying.

__________________
Jeremy Miller
Content Farmer - Optimized Automated Blog Posting

---

I forgot to Add IP Address to the list, thats very important for alot of things, such as banning or as a way to see if they have voted on something also.

__________________

---