Password protection for php 5.3.3? -

i'm doing assignment uni , i've been following guides far finding way hash registered password onto mysqli database seem's university's myphp on 5.3.3 , mysql 5.1.73.

what can use hash instead of using 5.5's password_hash() function? don't suppose there's handy tutorial out there it?

many thanks!

your best answer:

have them upgrade php 5.5 or higher , use password_hash() high work factor.

point them thomas pornin's canonical security.stackexchange answer how securely hash passwords? let him argue case password security.

your next best answer:

have them upgrade php 5.3.7 or higher , use password_hash() compatibility pack

see above.

your not answer:

you can use crypt on current php 5.3.3 version reasonably if change of options:

crypt('password', '$6$rounds=150000$perusercryptorandomsalt$') 

• $6 - use sha-512, has 64-bit operations reduce margin of advantage gpu based attackers have on of 2016.

• $rounds=150000 - set number of iterations hundreds of thousands or high tens of thousands of rounds.

• perusercryptorandomsalt - unlike password_hash, have yourself. need generate unique, cryptographically random salt of 12-24 binary bytes (16 reasonable)

  • note it's part of result string, in cleartext, correct.

  • that's binary bytes! size in crypt() function gets doubled if convert hex, or increased 4/3rds if base64 it

to compare, user's salt , number of rounds, , use crypt on candidate password entered. if same answer, it's same password.