3 ms·

Then would replacing md5() with hash_hmac('sha256' [= or whatever ], strtolower($username) [= data ], strtolower($password) [= key ] ) help against such an atta

Then would replacing md5() with hash_hmac('sha256' [= or whatever ], strtolower($username) [= data ], strtolower($password) [= key ] ) help against such an attack? If I understand correctly, this would have ruled out rainbow tables. Edit: clarified. BTW hash_hmac is built-in with PHP >= 5.1.2.

sbov 11y ago
The problem isn't just rainbow tables. Md5 is a fast algorithm. Sha256 isn't much slower than md5. You want anything auth related hashed using a slow algorithm - speed is your enemy. That's why bcrypt and the like are popular, because you can adjust how long it will take to calculate.