I'm trying to improve the security for my backend:
/**
* This is the script that is executed when I add a new user - after the input has passed the validation.
*/
$salt = base64_encode(mcrypt_create_iv(24,MCRYPT_DEV_URANDOM)); // generate a random 32 character salt
$hash = hash('sha256',$salt.$_POST['secret']); // create a 64 character hash based on the salt and the password
$ins = $con['site']->prepare('INSERT INTO users (handle, salt, hash) VALUES (:handle, :salt, :hash)');
$ins->execute(array(':handle'=>$_POST['handle'], ':salt'=>$salt, ':hash'=>$hash));
if($ins){
KD::addNotice('success','...message...');
} else {
KD::addNotice('error','...message...');
}
/**
* This is the script that is executed when the user is logging in - also after the input has passed the validation.
*/
$qry = $con['site']->prepare('SELECT handle, salt, hash FROM users WHERE handle = :handle');
$qry->execute(array(':handle'=>$_POST['handle'])); // look up the handle (username)
if($qry->rowCount()==1){
$get = $qry->fetch();
if(hash('sha256',$get['salt'].$_POST['secret'])==$get['hash']){
KD::addNotice('success','...message...');
session_regenerate_id();
$_SESSION['backend']->login($get['handle']);
} else {
KD::addNotice('error','...message...');
}
} else {
KD::addNotice('error','...message...');
}
This is as far as I've gotten and it works. I'm generating an unpredictable salt, creating a hash and saving it to a database. Although this is an improvement from what it used to be, I'm fully aware of that there's more work to be done here.
I've been reading a bit about iterations
. Or, rehashing the password, or the salt, or the hash, a couple of thousand times in order to prevent different forms of attacks. Could some of you please tell me how something like that could be implemented into my code?
Is it just putting some part of the code inside a for
-loop when creating and verifying the password?