Well the code is very simple and interesting. Hope someone gets some good use of this snippet.
Btw if you want to make something like UNIQUE ID for members, it's much easier and smarter to just hash (md5) "$user:$pass" or some other unique field plus some other just to add some more bytes
Sasa Karanovic www.MrdniSe.com www.SasaKaranovic.com
. . . the complexity of your key generation here is kinda silly. First, put some wholly-unnecessary arithmetic operations on the date components, and then you add the random factor. With a key like this, you either need it random or reproducible: yours is neither. It can never be reproduced from plaintext request values (unless you pass the random salt along, which you don't have any way to do), and it's far too much effort for a simply random id.
I've got good news, and I've got bad news: The universe is merely a figment of my imagination. Now are you ready for the bad news?
function checkable_key(){ // Keys are only valid on the day generated $date = date('m-d-Y'); // We share a secret $secret = 'secret_shared_between_client_and_server'; // I'll send you this salt in plaintext $salt = rand(); returnarray($salt,md5($date.$secret.$salt)); }
function check_key ($salt,$secret,$key){ // Can we match the passed key and salt using today's date and our // shared secret? returnmd5(date('m-d-Y').$secret.$salt) == $key; }
function random_id(){ // date adds keyspace size, rand adds unpredictability, // salt precludes rainbow table attacks global$system_salt; returnmd5($system_salt.rand().date()); }
Say for ex. am passing a value from one page to another page and use the function to create a key. If I want to verify / check the created random is key is a correct one, how to do that.
Correct me if am wrong. Can you mention the use of this script as well. so that I can understand clearly.
Btw if you want to make something like UNIQUE ID for members, it's much easier and smarter to just hash (md5) "$user:$pass" or some other unique field plus some other just to add some more bytes
Sasa Karanovic
www.MrdniSe.com
www.SasaKaranovic.com
I've got good news, and I've got bad news:
The universe is merely a figment of my imagination.
Now are you ready for the bad news?
// Keys are only valid on the day generated
$date = date('m-d-Y');
// We share a secret
$secret = 'secret_shared_between_client_and_server';
// I'll send you this salt in plaintext
$salt = rand();
return array($salt,md5($date.$secret.$salt));
}
// Can we match the passed key and salt using today's date and our
// shared secret?
return md5(date('m-d-Y').$secret.$salt) == $key;
}
// date adds keyspace size, rand adds unpredictability,
// salt precludes rainbow table attacks
global $system_salt;
return md5($system_salt.rand().date());
}
Say for ex. am passing a value from one page to another page and use the function to create a key. If I want to verify / check the created random is key is a correct one, how to do that.
Correct me if am wrong. Can you mention the use of this script as well. so that I can understand clearly.
Regards,
Kumar S
GuyFromChennai.com