I am new to PHP programming and trying to grasp the idea of hashing and encryption for protecting passwords, credit card details and such. I've done a lot of reading about MD5 which I think I understand the basics of now. I've seen places recommending that I use SHA2, which I don't understand how to implement.
Back to my question. I can understand how a script can tell if a password is correct or not by hashing the password and comparing the value against the hashed one in the database. My problem occurs when trying to understand salts. If I have a dynamic salt such as the date (yes, I have heard its a bad one to use), how does the script know that a password is correct because the salt will be different for the entered password and the one stored in the database.
For example: Say the original password was created on the 21/02/2011:
unhashed with salt:
mypassword210211
hashed with salt:
cbc0a790b2f28fc72ca43eb749028b9f
Then if I check my password today:
unhashed with salt:
mypassword30012012
hashed with salt:
e4af7ca7e263750a15be642d903c9ac9
They're completely different, so how does the script know that they are the same? Do I have to store the salt used on the specified password in the database so it knows what to use next time?
I'm rather confused and its highly likely that I am not understanding the whole hashing process properly. I've done my research, but whether I have done correctly or not I don't know.
bcrypt
or preferablyscrypt
instead. $\endgroup$