Storing hashed passwords in MySQL

views:

answers:

+7 Q:

Storing hashed passwords in MySQL

I'm creating hashed passwords using salted sha1 in PHP.

My question is: In MySQL what is the proper character encoding, field type & length to store the result?

Is there anything else in MySQL to consider for password security? Finally are SHA256 or SHA512 practical hashing choices?

+4 A:

For a SHA1 hash, CHAR(40) would be the optimal field type and length. Character encoding shouldn't matter much, all the characters are within the ASCII range. I'd go with the same character set as the rest of your database for consistency.

Rexxars 2010-02-23 16:05:28

+3 A:

The SHA-2 algorithms (SHA-256, SHA-512) are valid choices; however they require more storage. To store the hex digits for SHA-256, for example, you need a CHAR(64) field. There have been some questions about whether SHA-1 is "broken" Schneier discussed it and NIST commented. If those concern you, then it might be better to use one of the SHA-2 functions.

And if you want to increase the cost of a brute force attack, you might also consider adding some iterations using an algorithm such as PBKDF2. Someone posted an example here in the comments.

Mark Wilkins 2010-02-23 16:18:01

+1 A:

Anyone got any arguments against using md5 and storing them as char(32)?

vicatcu 2010-02-23 16:43:37

MD5 is too short these days, and has some serious flaws. For any new development, one of the SHA hashes (preferably SHA2) are a better choice.

friedo 2010-02-23 16:50:24

+1, i'm using it for years and the md5 js implementation is much lighter.

arthurprs 2010-02-23 16:51:55

ansaurus

tags:

views:

answers:

Storing hashed passwords in MySQL

related questions