3 ms·
Are you sure it's iterated? I just checked the manual for crypt() and it just says it's MD5 with a salt, but it could be a failure of the documentation.
by daeken 15y ago
Are you sure it's iterated? I just checked the manual for crypt() and it just says it's MD5 with a salt, but it could be a failure of the documentation.
- kragen 15y agoYes, see http://www.freebsd.org/cgi/cvsweb.cgi/src/lib/libcrypt/crypt-md5.c?rev=1.13.36.1;content-type=text%2Fx-cvsweb-markup http://www.freebsd.org/cgi/cvsweb.cgi/src/lib/libcrypt/crypt... where it says, "for(i = 0; i < 1000; i++)".
- antihero 15y ago1000 isn't very many at all in this day and age. And because MD5 has been actually broken I'd avoid it entirely. Use scrypt.
- nbpoole 15y agoOr bcrypt, which is actually implemented in PHP as part of the crypt function ;-)
- kragen 15y agoThis is tricky to answer. Of course I don't want to advocate using MD5, even iterated a thousand times, for both of the reasons you state. There are better alternatives. scrypt appears to be one of them, and if it stands up to analysis, it's better than PBKDF2 and bcrypt, which in turn are better than MD5-crypt. However, MD5 iterated 1000 times is still 1000 times better than MD5 iterated once (which an alarming number of codebases still use!) and the vulnerabilities that have been published in MD5 are not sufficient to speed up an attack on an MD5-crypted password file. So MD5-crypt is still vastly preferable to many alternatives, including traditional Unix crypt(), even though MD5 has been broken and DES hasn't.