Use the MD5 transform algorithm to prevent exhaustive decoding of passwords

MD5 is the most common cryptographic algorithm used in Web applications. Since the MD5 is irreversible, the ciphertext after MD5 calculation can not get the original text through the reverse algorithm. The intention of using MD5 encrypted text passwords in Web applications is to prevent the passwords stored in the database from being compromised and then being directly acquired. However, the attackers not only have a large number of password dictionaries, but also set up a lot of MD5 original/ciphertext control database, can quickly find common password MD5 ciphertext, is the efficient way to decipher MD5 ciphertext. However, the MD5 ciphertext database uses the most conventional MD5 encryption algorithm: The original-->md5--> ciphertext. Therefore, we can use the transform MD5 algorithm to make ready-made MD5 ciphertext database inactive. Here are some examples of transformation algorithms, which, of course, are similar in other Web development languages and have the same results. Transform one: Loop MD5 the easiest way to understand a transform is to perform multiple MD5 operations on a single password. Customize a function that accepts $data and $times two parameters, the first is the password to be encrypted, and the second is the number of times the encryption is repeated. There are two algorithms for implementing this transformation://Iterative algorithm function md5_1_1 ($data, $times = 32) {//cyclic use md5for ($i = 0; $i < $times; $i + +) {$data = MD5 ($data);} return $data; Recursive algorithm function md5_1_2 ($data, $times =) {if ($times > 0) {$data = MD5 ($data); $times--;return md5_1_2 ($data, $times); Implement recursive} else {return $data}}? > Transform two: Ciphertext split MD5 Although the user's password is an indeterminate string, a string of 32 characters is obtained once the MD5 operation is made, which can then be transformed against the fixed-length string. A bit of the BT algorithm is, this section of the cipher into a number of segments, for each section of a MD5 operation, and then the heap of ciphertext into a long string, and finally a MD5 operation, get still length of 32-bit ciphertext. The cipher is divided into two segments, each 16 characters function md5_2_1 ($data) {//Encrypt the password into 32 characters of ciphertext $data = MD5 ($DATA);//Divide the password into two paragraphs $left = substr ($data, 0, 16 $right = substr ($data, 16, 16);//encrypt and then merge $data = MD5 ($left). MD5 ($right);//Finally, the long string is encrypted again, becoming 32 characters Fumi Wan return MD5 ($DATA);} Divide the cipher into 32 segments, 1 characters function md5_2_2 ($data) {$data = MD5 ($DATA),//iterate over each character in the ciphertext and encrypt, connect for ($i = 0; $i <; $i + +) {$data . = MD5 ($data {$i}); At this time $data length is 1024 characters, again MD5 Operation return MD5 ($DATA); > Of course, this secret text segmentation of the specific algorithm is countless, such as the original ciphertext can be divided into 16 paragraphs per paragraph two characters, 8 paragraphs per paragraph 4 characters, or the number of characters in each paragraph is not equal ... Transform three: Additional string interference in one step of the encryption process, attach a content-determined string (such as user name), interfering with the encrypted data. You cannot use random strings, because this makes the original algorithm impossible to reproduce. This algorithm in some cases is very advantageous, for example, for a large number of user password encryption, you can use the user name as an additional interference string, so that the attacker even know your algorithm, it is difficult from their hands in the dictionary to generate a large number of tables, and then a lot of deciphering user passwords, Only targeted to the poor to mention a small number of users. The attached string is at the tail function md5_3_1 ($data, $append) of the original data {return MD5 ($data. $append);} The additional string is in the header function Md5_3_2 ($data, $append) of the original data {return MD5 ($append. $data);} Additional strings are Md5_3_3 ($data, $append) {return MD5 ($append. $data. $append) at the ends and ends of the original data; > Transform four: Case transformation interference because the MD5 () function returned by PHP is all lowercase, we can capitalize all of them and then do a MD5 operation. function Md5_4 ($data) {//cipher First $data = MD5 ($DATA);//Then the English mother in the ciphertext is converted to uppercase $data = Strtotime ($data); Finally, a MD5 operation is performed and returned to return MD5 ($DATA); > Transform Five: String order dryThe sequence of the ciphertext string after the MD5 operation is reversed, then a MD5 operation is performed. function Md5_5 ($data) {//the ciphertext $data = MD5 ($data) of the data, and/or the character order of the ciphertext string is reversed $data = Strrev ($data); $DATA); > Transform six, Transform seven, transform eight ... MD5 transform algorithm is countless, and even do not need to create their own, using the above five combinations can make a very BT algorithm. For example, after the first cycle of encryption and then split, and each paragraph appended with a string and then encrypted separately, and then transform the case and reverse the sequence of strings into a long string and then MD5 operation ... If it is really unfortunate, because some vulnerabilities, such as SQL injection or file system in the database is downloaded and the user password data exposure, then MD5 transform algorithm can greatly increase the difficulty of deciphering the original password, the first is to make a lot of online MD5 original/ciphertext control database (to know , which is the most efficient way to decipher MD5, is not used, and then the attacker uses conventional algorithms to get a bunch of ciphertext from the transformation algorithm and get burned. Of course, the MD5 transform algorithm is particularly suitable for use in non-open-source Web applications, although the advantages of using in open source programs will be weakened (we all know the algorithm), but also can inhibit the MD5 text/ciphertext control database function. To carry out these complex transformation operations, of course, it will cost more system overhead, but for security requirements of the system is very strict, more to pay for a higher security, it is entirely worthwhile. Responsible Editor: Snowflake (TEL: (010) 68476636-8008) to force (0 votes) (0 votes) of nonsense (0 Votes) Professional (0 Votes) The title of the party (0 Votes) passed (0 Votes) The original text: Use MD5 transform algorithm to prevent poor lift decipher password return to network security home