Is my hashing technique secure?

Question

I am not sure if this is the best place to post this type of question.

I have come up with function which, I believe, is a very secure method of hashing. (I could be completely wrong).

Here's the code:

function hashPW($password){
    $letters = array('a','b','c','d','e','f','g');
    $numbers = array(1,2,3,4,5,6,7);
    return str_replace($letters,$numbers,md5($password));
}

"password" outputs as 56443332511765461483274528823699

I am not too sure if this a secure method. My thoughs were that it's hard to know which numbers were actually a letter or number from the md5.

If this isn't a good option to use for my PHP web application, could you suggest something that is.

Thanks.

There are many out of the box hashing methods out there, why are you writing your own? — GdD, Feb 08 '14 at 22:48
Rolling your own scheme is not advised. See [How to securely hash passwords?](http://security.stackexchange.com/q/211/12) for secure password hashing options. — Xander, Feb 08 '14 at 22:49
Your scheme is flawed because it relies on the secrecy on your algorithm rather. `md5` is fast and you just apply a substitution thereafter, similar to what Dave did (see answer below and Xander's link). — Lekensteyn, Feb 08 '14 at 23:21
As addition to all other information you have been given, consider that you have a problem with your Hash, in fact you could have two or more different passwords with the very same hash so if you use this for production you might find that: if a password gives a hash "abcd" it will turns "1234", but you could also use to "log in" password which MD5 is "a234", "1b34", "1234", "123d"... So it is way more insecure. — kiBytes, Feb 10 '14 at 07:25

score 9 · Accepted Answer · edited Mar 17 '17 at 13:14

On general principles: Don't roll your own crypto. It's absolutely sure that you'll get it wrong.

You're taking MD5, and then applying a fast transformation. This makes your scheme worse than MD5. “It's hard to know which number were actually a letter or number” — so what? MD5 isn't cracked by applying the reverse transformation: no one knows how a fast way of computing the reverse transformation. What people do is to compute MD5(P) for many, many values of P (billions and more). Computing your own transformation from MD5(P) is extremely fast, so your transformation is as easy to crack as MD5.

This is a bad hashing technique. Don't roll your own. Read How to securely hash passwords?. Yes, I know it's long. I'll wait.

Now that you understand that a password hashing function needs to be slow and salted, use a standard one. PHP (recent enough versions) has a password_hash function; the default mode uses bcrypt which is fine.

Thanks for your explanation. I just wanted to know how and why this function isn't safe. Thankyou! :) — ryryan, Feb 09 '14 at 10:32

Is my hashing technique secure?

1 Answers1