MD5 and Salt

[JayJay]

Is there any way to change the current salt to something different? And if so, how would I go about doing this?

Would I need to change the following in functions_user.php:

// ###################### Start makesalt #######################
// generates a totally random string of $length chars
function fetch_user_salt($length = 3)
{
	$salt = '';
	for ($i = 0; $i < $length; $i++)
	{
		$salt .= chr(rand(32, 126));
	}
	return $salt;
}

[Marco van Herwaarden]

The salt is randomly generated for each user and stored in teh user table. Why you would want to change that?

[Zero Tolerance]

Well, if you wanted you could change it, if you wanted to change the length, change:

$length = 3

to your number, like: $length = 5.

If you wanted to change the characters contained within the salt, then change this line:

		$salt .= chr(rand(32, 126));

I don't really recommend changing anything though, i see no reason as to why it would needed to be changed.

- Zero Tolerance

[Colin F]

I'm not sure if your users wouldn't have to reset their password if you change the salt though...

[Zachery]

Originally Posted by Colin F

I'm not sure if your users wouldn't have to reset their password if you change the salt though...

Should be fine, salt is only generated on register or password change, it shouldn't matter in the long run..

[Colin F]

Originally Posted by Zachery

Should be fine, salt is only generated on register or password change, it shouldn't matter in the long run..

sure, but isn't the encrypted passsword in the database md5'd with salt?

If so, and you change the salt of a user, it wouldn't be able to match up the passwords, I'd think.

[Zero Tolerance]

Originally Posted by Colin F

sure, but isn't the encrypted passsword in the database md5'd with salt?

If so, and you change the salt of a user, it wouldn't be able to match up the passwords, I'd think.

Yeah changing the users salt would mess things up, however changing that (the above code) would only affect new registered users.

- Zero Tolerance

[Zachery]

Originally Posted by Colin F

sure, but isn't the encrypted passsword in the database md5'd with salt?

If so, and you change the salt of a user, it wouldn't be able to match up the passwords, I'd think.

Like ZT said.

[AN-net]

so everytime a password is reset or changed the salt is changed?

[Zachery]

Originally Posted by AN-net

so everytime a password is reset or changed the salt is changed?

Hmm Not sure actually, take a look at the function I think it only counts for new salts.