问题
what is PHP's safest encrypt/decrypt method, in use with MySQL - to store let's say passwords?
Of course, not for portal purposes - hashing is the safest option there.
I want to do little password (domain/mysql/ftp...) storage for our whole team online, so we could log in and check to passwords, but I don't want really to endanger our clients' bussinesses. Hash can't be used for obvious reasons - we need to get the passwords in readable form back, after logging in - (Doesn't really make sense to run rainbow tables every time :D).
Any idea?
Edit: so far, there was just mysql-level AES. Do you think anything would be better/safer or do you have any experience with 3rd party open source code?
回答1:
If you want encrypt and decrypt then you may wish to consider MySQL's built-in AES encryption. This allows you to use a salt (even a random salt for each item) and then store the encrypted data as a binary blob. You can then fetch the salt or use a stored one, and decrypt the data.
There's a good tutorial on AES encyrption/decryption here: http://techpad.co.uk/content.php?sid=82
回答2:
I would say MD5 is a good choice since you could use MD5() at MySQL level as well. Then again, you would save your passwords plain in the DB.
base64 < MD5 < SHA1
回答3:
@Adam, I must agree that safer way is to use mysql AES crypt and to save key in PHP. That way, if hacker somehow get DB he won't be able to open without key in PHP.
You can play with key (ex, crypt PHP code/playing with eval()) so hacker would be confused if he would get DB & PHP code together...
回答4:
The safest is a method that you would create on your own. Try combining many of the easy to break encryptions in random order and you get something that is really hard to break. Sub encryption + reverse + randomization would make something that is really hard to break unless you know what exactly is going on and in what order.
来源：https://stackoverflow.com/questions/2574341/safest-lamp-encrypt-method