Creating hashes for passwords

Question

I am creating a custom CMS and have built a login system and was wandering how vulnerable hashing the passwords this way would be compared to just using the md5 php function like this:

<?php $token = md5($salt . $password . $pepper); ?>

Most people just add a salt but adding pepper just makes sense if your going to add salt :)

Here is how I am doing it

<?php $token = hash_hmac('sha512', $salt . $password . $pepper, $key); ?>

The $key would be a value in the database that is unique to each user. The $salt and the $pepper are randomly generated strings. The $password is the password of course.

Added on 07/24/09

Thanks for all your responses. Does anyone have an examples of how they do a hash script for creating passwords to store in a database?

Answer 1

Your method is using a stronger hash.

I don't see you opening yourself to any extra vulnerabilities.

Answer 2

Similar to: http://stackoverflow.com/questions/1111494

Make sure you read this:

http://www.matasano.com/log/958/enough-with-the-rainbow-tables-what-you-need-to-know-about-secure-password-schemes/

And this:

bcrypt is obsolete

Answer 3

MD5 is not suitable for any cryptographic purpose, use SHA-1 or preferable SHA-256.

http://www.mscs.dal.ca/~selinger/md5collision/