Intrepid Blog » md5 http://blog.affien.com A few thoughts Mon, 01 Mar 2010 00:58:01 +0000 http://wordpress.org/?v=2.9.2 en hourly 1 md5(microtime()) http://blog.affien.com/archives/2006/12/03/md5microtime/ http://blog.affien.com/archives/2006/12/03/md5microtime/#comments Sun, 03 Dec 2006 22:52:50 +0000 Bas Westerbaan http://blog.w-nz.com/archives/2006/12/03/md5microtime/ Don’t use md5(microtime()). You might think it’s more secure than md5(rand()), but it isn’t.

With a decent amount of tries and a method of syncing (like a clock on your website) one can predict the result of microtime() to the millisecond. This only leaves about a 1000 different possible return values for microtime() to be guessed. That isn’t safe.

Just stick with md5(rand()), and if you’re lucky and rand() is backed by /dev/random you won’t even need the md5(). In both cases it will be quite a lot more secure than using microtime().

]]> http://blog.affien.com/archives/2006/12/03/md5microtime/feed/ 0