I recently thought about a secure password storing mechanism.
I wanted to ask if the following password storing mechanism is resistant against rainbow tables with a secure password and the attacker knowing the hashing and salting mechanism.
Instead of using a randomly generated salt, the salt is derived from the password. Therefore the salt also isn't stored in the database.
- User types in password (
$password = "MySecurePassword123")
$passwordis being hashed with sha256 (
$hashed_pw = ccf9ac1c9ce02b9bb7810a1fff51e474f37d98c3582f2d3b5036caf559afd9bc)
- First 5 (let's say min. password length is 8) characters from
$passwordare hashed using sha256. Let's call the resulting hash 'salt'. (
$salt = 52824aa0d517c8d6e24d59e1374ee202e97ba730b00ae577c94cdf157cbc29af)
$saltis being appended to
hashed_pwand hashed again with sha256 (
$result = sha256($salt + $hashed_pw) = 63617328f94d025f2489f170388b42d954a73391250b0ad29bbfb7ce2f8373e1)
$result is being stored in the database.
Used tool for generation of sha256 hashes: https://emn178.github.io/online-tools/sha256.html