phpass HAVE BEEN CRACKED! What is the solution?

[eluser]bretticus[/eluser]
[quote author="trs21219" date="1245217044"]
mine does both. it uses a random salt for each user combined with their password and on the other end is what i call 'pepper' which is exactly like the encryption key but a different string. this way if they steal your db they don't have the one that is in the code. which makes it impossible to access the passwords (without 500 super computers and about 10,000 years)[/quote]

So you store some random salt with the user record? Then you hash that with the user's real password, plus your "script-side" static string to make the password hash in the user record?

That would go a very long way to prevent a rainbow table from exploiting the password if the data were stolen, but I would think just hashing the real password + the "script-side" code with sha256 (or better) ought to be sufficient as a collision is the only thing the hacker needs. To gain access to your website, if he or she can produce a password, which combined with your static salt, will result in the desired hash (which is why md5 is not really safe) then that is good enough without ever knowing the real password. If you used a strong hashing algorithm (you can upgrade php hashing algorithms via the suhosin extension) and a moderately strong "script-side" randomly-generated static string, you'd have my approval easy.

EDIT: Apparently "hash" has the same upgraded hash algorithms if you have PHP 5 >= 5.1.2 (as demonstrated in above post.)