生成用户唯一的hmac密钥以进行密码散列

Question

For my website's password hashing I wrote the following function:

public function hash($user) {
    $user_key = hash_hmac('sha512', $user['id'].$user['email'], $this->site_key);
    $password = hash_hmac('sha512', $user['password'], $user_key);
}

I generate user unique keys to use for the final password hashing. Because this key is hashed with sha512 it should give enough security based on what I read on wikipedia:

The cryptographic strength of the HMAC depends upon the cryptographic strength of the underlying hash function, the size of its hash output length in bits and on the size and quality of the cryptographic key.

I have not seen this way if hashing passwords before and was wondering if it is good enough?

Extra: I have not used a salt because I think hmac appends the provided key to the data (like a salt), is this right?

Answer 1

OK, first and foremost. Do not write up your own function to do password hashing. I'm not doubting your skills, but to be safe do not do your own hashing system. And an HMAC your key is OK, but I'd still not use it.

Finally I'd suggest that you do this for your users passwords.

<?PHP

$password=$user['password'];
$username=$user['username'];

$salt='usesomesillystringforsalt';
$hashed_password=crypt($password.$username,'$2a$04$usesomesillstringforsalt$');

?>

This algorithm uses Bcrypt which is based upon Blowfish it is a very robust algorithm and is what Gawker media went to after they were hacked due to the robustness and usefulness for password hashing. crypt ^{PHP Manual}

Next up, remember to change the part that says usesomesillystringforsalt to something else. It needs to be 22 digits of base64 salt A-Z,a-z,0-9,/ and "."

Go to that link to find out more about the algorithm itself. I suggest that you just use this implementation as it is much much stronger than the one that you were suggesting.

If you want to go a step forward, I'd suggest that you use a unique salt for every user. If you want to do that, I can write up an example function which will show you how to do that.

As stated, if you have any more questions feel free to ask.