Unstoppable Domains โ€” Get your daily AI drops report

Reversable Encryption OR Storing Passwords online

SpaceshipSpaceship
SpaceshipSpaceship
NamecheapNamecheap
Watch

PoorDoggie

Soon to be RICHdoggie!VIP Member
Impact
18
I need to store people's passwords online in a mysql database. The point is that they need to be able to be "got back".

ie: user x logs in and then it gets another of his passwords that he gave us, from a mysql database.

obviouslly to bring up the the second password it means that I can't store it in md5 format because that is irreversible (i think).

Is there any way of making those passwords secure with the option of getting them back?

Thanks
Tom
 
0
•••
The views expressed on this page by users and staff are their own, not those of NamePros.
Unstoppable Domains โ€” AI StorefrontUnstoppable Domains โ€” AI Storefront
abdulmueid said:
nasaboy007: Hash means one way encryption and encryption is, well you know, encryption.

Haha, well put, but let me elaborate a little.

Hashing is a method of encryption where there isnt a way to decrypt. However, if you get your hands on a hash, you can always "brute force" it. This means basically putting into a program where it checks the hashed string against a giant list. (If you hash the same thing twice it will always have the same hashed result.)

And that is why having dictionary words as a password makes it weak. The first thing a brute forcer will do is check it against a dictionary list for a match, and then move onto number combinations.

Which means if your password is a combination of upper case, numbers, lower case and irregular characters, they would have to be running your password against a list infinitely large, which your average computer would take months or even years to crack.
 
0
•••
Ok guys - here is the code, if you wanted to know:
PHP:
<?php

function encrypt($str,$key){
  for($i = 0; $i < $key; $i++){
    // we want to encrypt each letter as many times as the $key val
    $n = 0;
    $newstr = "";
    while(isset($str{$n})){
      $newstr .= "!".base64_encode($str{$n});
      $n++;
    }
    $str = base64_encode($newstr);
  }
  return $str;
}

function decrypt($str,$key){
  for($i = 0; $i < $key; $i++){
    $str = base64_decode($str);
    $n = 0;
    $newstr = "";
    $bits = explode("!", $str); // we have split the string into seperate letters
    $fullstr = "";
    while(isset($bits[$n])){
      // decode a letter at a time
      $letter = base64_decode($bits[$n]);
      $fullstr .= $letter;
      $n++;
    }
    $str = $fullstr;
  }
  return $str;
}

if(isset($_POST['key']) && isset($_POST['str']) && isset($_POST['mode']) && ($_POST['mode'] == "encrypt" || $_POST['mode'] == "decrypt")){
  // we have vars
  $key = $_POST['key'];
  $str = $_POST['str'];
  $str = str_replace("!","",$str);
  $mode = $_POST['mode'];
  ?>
    <table>
      <tr>
        <td><textarea style="width: 850; height: 400" onFocus="this.select()"><?php if($mode == "encrypt"){ echo encrypt($str,$key); } else { echo decrypt($str,$key); } ?></textarea></td>
      </tr>
    </table>
  <?php
    }
    else{
  ?>
  
    <form method="post" action="<?php echo $_SERVER['PHP_SELF']; ?>" onSubmit="if(key.value>10){alert('Sorry, please keep the value of the key below 5, thanks.');key.value='5'};">
    
      String: <input name="str" /><br />
      KeyVal: <input name="key" /><br />
      Mode:ย ย  <select name="mode"><option value="encrypt">Encrypt</option><option value="decrypt">Decrypt</option></select><br />
      Submit: <input type="submit" value="Do it!" />
    
    <form>
  
  <?php
}

?>
storing keys in a seperate database may make it more secure or you could write some algorithm for storing the "key". Key in this case just means how many times you want it encrypted that way.

The only point I would mention is that the longer the string and the higher the "key" the longer the resulting string and therefore will take up more space in the database.

Just a question regarding hashes... - how can they be unreversible? surely that is impossible right?
 
0
•••
PoorDoggie: Your script is basically base64 on steroids (with keys). Actually it is still possible to reverse it by trying various keys.

MD5 is a irreversible hash. There is no real way to reverse it except use methods like brute-force or dictionary attack which is basically guessing and encrypting different combinations of alphabets and numbers and matching it with the encrypted string until right combination is found.
 
0
•••
but i dont understand, if the same cleartext input will always have the same hash, there must be SOME function/algorithm that the program is performing in order to get the hash, otherwise it would always be different. therefore, y can't sum1 just figure out this algorithm (example: that md5 uses) and just reverse it?
 
0
•••
although potentially reversible, I am sure that that kinda encryption would be good enough for my site. I may look at mcrypt though. I thought my script was quite cool - it takes each letter of a string and base64 encodes each of them. It then keeps doing that with the latest encrypted string as many times as the "key" variable dictates. I think it would be very hard to try and decypher without the algorithm.

what is a hash exactlly? and repeating my question above, how can it be irreversible? surely if it goes one way, it can come back?
 
0
•••
From what i've read, mcrypt and base64 use a fixed algorithm for encrypting data so they know that by reversing that algo, it is decrypted.

Now a hash like MD5 generates a random algorithm at the time of encryption, encrypts the string and now the algorithm doesn't exist anymore.. therefore irreversible. Correct me if I am wrong.. someone.
 
0
•••
wow, that is absolutely ingenious! :) I would never have thought of that.

Theoretically, that algorithm is reversible if found out though right?

I am thinking if there is anyway of doing something like that, but then with a reversible function. Maybe storing an encryption key in the string or something? I suppose it will still be reversible, but then again the more ambiguous, the more secure right?
 
0
•••
A hash is definately more secure than anything else... but I would still prefer to have my own algorithm.

And yes, the more ambiguous, the more secure..
 
0
•••
Now a hash like MD5 generates a random algorithm at the time of encryption, encrypts the string and now the algorithm doesn't exist anymore.. therefore irreversible. Correct me if I am wrong.. someone.
how could that be? if it made a new algorithm each time, it would not get the same result from the same input text each time.


I am thinking if there is anyway of doing something like that, but then with a reversible function. Maybe storing an encryption key in the string or something? I suppose it will still be reversible, but then again the more ambiguous, the more secure right?
as for that, how about u just pick like the 2nd letter (or better yet, make it like the second to last letter so that it changes depending on the length of the actual password) and convert that into binary. then once thats binary i guess u cud convert that back into its numerical value rather than text and use that as ur key value. of course, this number will most likely be INSANELY GINORMOUSLY LARGE for the purpose of base64 multiple times. so i suggest then taking that base 10 (decimal) value and subjecting it to various mathematical functions that will bring it down to a smaller value if it is over a certain value. of course, if the number comes down to something less than 10 (or w/e) it sumwhat defeats the purpose of doing all this since u wanted to generate a key that would be hard to brute force...

well if there was a better way to encode (much much faster) than base64, that method above (minus the whole make the humongous number smaller thing) would probably be the best bet.


as for decrypting it... ehhhhhhhhh


-_- damn it i did all that work and realized that it would be impossible (or next to impossible) to decode that sort of encryption without the original password...

well unless sum1 can think of one, cuz my brain is fried X_X


but hey thats a good idea :P
 
0
•••
lol - I think I will just take a key and do hurrendous mathematical stuff to it, and then base64 it a few times depending on the size of the resulting number! :) lol - a long string is a little bit OTT maybe.
 
0
•••
I was thinking yesterday, that if you did a few random string manipulation things and character replacements before you md5() the string, it would be a million times more secure...because, when the hacker brute forces the hash, instead of getting the password he'll get the manipulated version, and they'd still have to know what replaces what before they get the original...

And now that I think about that...imagine having a set of string replacements, then md5()'ing it, THEN manipulating the hash AGAIN and then md5()'ing it again...
 
0
•••
kinda like my base64 method, but with md5? Thats a good idea, just to make it that little bit more secure. What I have done in the past is taken the first 16 letters of an md5 string and put them at the end. This way the string is different, but it also means more php code, and less efficient code.
 
0
•••
but i thot the whole point of this was to make it decryptable... whats the point of using md5 if u cant decrypt that?
 
0
•••
Just so you know, md5 is way more efficient than base64. Multiple instances anyways. On my server it seems to be different.

http://www.ncisolutions.com/misc/base64_md5.php

Try it out on your own server:

PHP:
<?php 
function dbConnect(){
	mysql_connect("localhost","*************","******")
		or die("Couldn't connect to the database because ".mysql_error());
	mysql_select_db("*************")
		or die("Couldn't select database because ".mysql_error());
}

function randomChar($length)
{
$password = "";
$possible = "0123456789abcdefghijklmnopqrstuvwxyz";
$i = 0;
while ($i < $length) {
$char = substr($possible, mt_rand(0, strlen($possible)-1), 1);
if (!strstr($password, $char)) {
$password .= $char;
$i++;
}

}
return $password;
}
$string = randomChar(rand(7,rand(8,rand(9,rand(rand(15,21),rand(22,37))))));
for ($i=0;$i<50;$i++){
$timeparts = explode(' ',microtime());
$thetime = $timeparts[1].substr($timeparts[0],1);

$md5_string = md5($string);

$timeparts = explode(' ',microtime());
$starttime = $timeparts[1].substr($timeparts[0],1);
$timeparts = explode(' ',microtime());
$endtime = $timeparts[1].substr($timeparts[0],1);
$difference[$i] = bcsub($endtime,$starttime,6);
}
$md5_endtime = (array_sum($difference))/50;

for ($i=0;$i<50;$i++){
$timeparts = explode(' ',microtime());
$thetime = $timeparts[1].substr($timeparts[0],1);

$base64_string = base64_encode($string);

$timeparts = explode(' ',microtime());
$starttime = $timeparts[1].substr($timeparts[0],1);
$timeparts = explode(' ',microtime());
$endtime = $timeparts[1].substr($timeparts[0],1);
$difference[$i] = bcsub($endtime,$starttime,6);
}
$base64_endtime = (array_sum($difference))/50;

echo "<b>Original String:</b>".$string."<br><br>";
echo "<b>Final md5 Time:</b> ";
echo number_format($md5_endtime, 70, '.', '');
echo "<br>";
echo "Final md5 String: ";
echo $md5_string;
echo "<br><br><b>Final base64 Time:</b> ";
echo number_format($base64_endtime, 70, '.', '');
echo "<br>";
echo "Final base64 String: ";
echo $base64_string;
echo "<br><br><b>Fastest:</b> ";
dbConnect();
if ($md5_endtime < $base64_endtime) 
{
	echo "MD5 <br><b>By</b> ".number_format($base64_endtime-$md5_endtime, 70, '.', '')." <b>seconds</b>.";
	$query = mysql_query("SELECT * FROM `base64_md5`");
	$row = mysql_fetch_array($query);
	$newval = $row['md5']+1;
	mysql_query("UPDATE `base64_md5` SET `md5` = '$newval' WHERE `id` =0 LIMIT 1 ;");
}
if ($md5_endtime > $base64_endtime) 
{
	echo "Base64 <br><b>By</b> ".number_format($md5_endtime-$base64_endtime, 70, '.', '')." <b>seconds</b>.";
	$query = mysql_query("SELECT * FROM `base64_md5`");
	$row = mysql_fetch_array($query);
	$newval = $row['base64']+1;
	mysql_query("UPDATE `base64_md5` SET `base64` = '$newval' WHERE `id` =0 LIMIT 1 ;");
}
echo "<center><b><br><br>Total Wins</b><hr></center><br><br>";
$query = mysql_query("SELECT * FROM `base64_md5`");
$row = mysql_fetch_array($query);
echo "<b>MD5:</b> ".$row['md5']."<br>";
echo "<b>Base64:</b> ".$row['base64'];
echo "<br><br><b>Last Calculation:</b> ".$row['date'];
mysql_query("UPDATE `base64_md5` SET `date` = '".date("Y-m-d h:i:s")."' WHERE `id` =0 LIMIT 1 ;"); 
mysql_close();

Someone else from NamePros originally gave me this script. I can't remember who it was, sorry. I did make some modifications though.

Thanks to t.m. for the random characters function.

*Added database functionality to track wins/losses
 
Last edited:
0
•••
nope... base64 is more efficient, it has won way more times...
Tree said:
Just so you know, md5 is way more efficient than base64

nasaboy: I wan't using md5 as an encryption option, but merely explaining methods of storage I have used in the past.

Tom
 
0
•••
Multiple instances of md5, I believe, is faster than multiple instances of base64. But it may be server-specific. I don't know. That's why I want people to try the code themselves.
 
0
•••
Olitt โ€” high-converting AI websites, only from $1/moOlitt โ€” high-converting AI websites, only from $1/mo
Escrow.com
Spaceship
Domain Recover
CryptoExchange.com
Catchy
DomDB
NameFit
  • The sidebar remains visible by scrolling at a speed relative to the pageโ€™s height.
Back