What is the diff between the hashing methods of php?

Question

What is the difference between the hashing methods available in php

md2 md4 md5 sha1 sha224 sha256 sha384 sha512 ripemd128 ripemd160 ripemd256 
ripemd320 whirlpool tiger128,3 tiger160,3 tiger192,3 tiger128,4 tiger160,
4 tiger192,4 snefru snefru256 gost adler32 crc32 crc32b salsa10 salsa20 
haval128,3 haval160,3 haval192,3 haval224,3 haval256,3 haval128,4 haval160,
4 haval192,4 haval224,4 haval256,4 haval128,5 haval160,5 haval192,
5 haval224,5 haval256

I generally use md5 to store passwords in my db..

I searched for it but i couldn't get exact advantages and disadvantages..

Answer 1

Wikipedia is a good starting place to read about these different algorithms, and find comparisons between them.... but what do you expect to find in a list of advantages/disadvantages

Answer 2

The differences are that of the algorithm used, which also determines the size of the output (e.g. md5 produces 128bit output, sha 160 bits).

md5 and sha1 have weakness that have been discovered (collisions in the hash space), though for most purposes md5 is sufficient unless you're working on banking site.

You MUST however use a salt (regardless of the hash algorithm used), just using the md5 of the password for example leaves you potentially vulnerable to a rainbow attack.

Edit: This is more of a crypto question than PHP per se

Answer 3

Those are all different algorithms. Some of them are cryptographic hashes, some are simple checksums (such as crc32 and adler32) that are very fast to compute but should never be used for cryptographic purposes.

MD5 and SHA-1 used to be the standard cryptographic hashes, but recently weaknesses have been found in both. You're probably best off using the newer SHA-256 for cryptographic purposes. The other new SHA variants use fewer or more bits but aren't fundamentally different.

You can probably find more detailed information about most of those algorightms on Wikipedia.

Answer 4

You don't want to use md5 or any "simple" hash to store passwords in a database. You want a good salt and bcrypt. The phpass library provide a good portable way to implement a not too weak password storage.