As an exercise in password storage i implemented a PHP function that takes a UTF-8 encoded Unicode cleartext, generates a random salt and produces a password hash using the MD5 algorithm.
Please note that this is just an exercise and should not be used in production.
- This code has not been properly tested and has never been reviewed. I think it’s OK for educational purposes (otherwise i would not have published it), but it is very likely to have bugs.
- There are computational attacks on MD5 that break the algorithms fundamental promises, they can be performed without extraordinary effort. That makes MD5 unusable for security-related purposes in the general case.
- For PHP version 5.5 and later, you can use the password hashing API instead.
At any rate, it can be helpful to understand what the use case is and what „password hashing“ actually can accomplish. Read on for further observations.
