Making Hash

Most companies use a simple sequence counter for their orders. When you get your order, you can see how many orders they have placed.

My user id on SteemIt is 912,570. My ID shows that I am a relatively late adapter of SteemIt, but i can still brag that I am less than a million.

I think this is fun information. But lets say you don't want people to know the sequence number. The easiest way to obfuscate an id is to select a large prime number P and a second number M between P and P squared. You would multiply the id by P and do modular division by M. You now have a seemingly random set of M unique numbers you can use as ids.

When I design programs for clients, I usually pull this trick on both the customer numbers and invoice numbers.

This post is about password security. Anyone who has physical access to a machine can find a way to break in and steal passwords stored on that machine.

This is why you are supposed to use a different password on each web site you use. If you used the same user name and password on Yahoo as your bank account; then the people who stole the user database from Yahoo could access your bank account!

Smart companies hash passwords on their machines. A decade ago industry experts recommended using MD5 and SHA1 for hashing the passwords. Simply hashing isn't sufficient. All the users who use "letmein" as their password have the same hash. Hackers have "rainbow tables" that show the hashes of passwords encrypted with MD5 and SHA1.

I would use the funky customer ids as the seed for the hash program. Hackers can still use brute force techniques to decrypt the password.

The current thinking about password hashing is that one needs a "computationally intense." The password hash recommended by PHP consumes a fair amount of computer time to generate a hash and spews out long strings like "$2y$10$.vGA1O9wmRjrwAVXD98HNOgsNpDczlqm3Jq7KnEd1rVAGv3Fykk1a" which are costly to store in the database.

A hacker has all the computer time that he can steal, while I still have to pay for my resources.

So, for my current project I am thinking of writing my own hash and I will use numbers as the password instead of strings. Here is the basic algorithm.

function vsHash($id, $key) {
  // Using the "bit and" plus this mask is the same as modular division by 2^32
  // I apply the mask between each operation so that my figures stay under 2^64.
  $mask = (1 << 32) - 1;

  // I obfuscate the ID by miltiplying it by a PRIME.
  $idObf = (($id & $mask) * PRIME_A) & $mask;

  // I split the key in two and multiply them by $idObf and by two other primes.
  $low = ((((($key ^ PRIME_B) & $mask) * $idObf) & $mask) * PRIME_C) & $mask;

  $high = (((($key >> 32) + $idObf) & $mask) * PRIME_D) & $mask;

  return $high + ($low << 31);
}