Encrypt and decrypt passwords in php

What is the best way to encrypt a password to store in mysql databese? I mean in both ways ( encryption and decryption)?

I read about md5 is not enough since it's easly be decrypted....

What do you suggest i should do to hash passwords and decrypt it?
LVL 1
BRMarketingAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

ste5anSenior DeveloperCommented:
The best way? The best way is not to store passwords. Store a salted hash instead.
1
Dave BaldwinFixer of ProblemsCommented:
Hashes like MD5 and SHA are one-way functions.  MD5 takes some serious computing power to break it.  SHA takes more.  Where there is no financial reward for 'breaking' the passwords, MD5 is still used because it is good enough.

This page addresses what PHP provides: http://php.net/manual/en/faq.passwords.php  And more info: http://phpsec.org/articles/2005/password-hashing.html
0
Russ SuterCommented:
There are 3 ways to handle credential validation: They are (in order of best to worst solution)

1. Store a hashed value using a strong hashing algorithm like SHA-256. When a user provides his/her credentials, hash the input and compare the hashes. If they match then you can authenticate the user. This is the best practice and should be used in 99% of cases.

2. Store the password in an encrypted format. When a user provides credentials, decrypt the stored value and compare it to the plain-text input. Use this only when necessary for some reason. If you have a requirement that passwords are recoverable this is the solution.

3. Store the password in plain-text. Use this method only if you're a complete idiot.
0
Cloud Class® Course: Ruby Fundamentals

This course will introduce you to Ruby, as well as teach you about classes, methods, variables, data structures, loops, enumerable methods, and finishing touches.

gr8gonzoConsultantCommented:
MD5 cannot be decrypted. Hashes are one-way functions. MD5 is considered weaker than other hashes, and you have databases out there that try to "decrypt" hashes by simply storing billions of varieties of hashes so you can find a matching one. Salting the hash refers to adding a known prefix like "Braveheartli" to the beginning of every string before it is hashed. That way, even if you do find a matching hash in some database out there, it won't work once the salting takes place because the salting makes the string different.

You should never depend on decrypting passwords. Any kind of decryption is weak. As ste5an said, use a salted hash. You can use salted MD5 or SHA1 or something stronger, but it's generally your best way to go.
0
BRMarketingAuthor Commented:
Thank you all,
So i should use salted hash and to store passwords, when i check the passwords i actually check the hash version of the password to compare if it is valid or not?

Right?
0
Russ SuterCommented:
To clarify what you wrote above. You don't store the passwords anywhere. You use a hashing function with the password as your input and store the resulting hashed value. You then hash any user input in the same manner and compare the resulting hashes to determine if there is a match. The only known attack on a hash is brute force. MD5 has been around a long time and is one of the weaker hashing algorithms. SHA-256 is the preferred method these days. Regardless of which hashing algorithm you use it is guaranteed to be more secure than storing encrypted data.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
BRMarketingAuthor Commented:
Thank you all
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
PHP

From novice to tech pro — start learning today.