phanalist

E0057: MD5 or SHA1 Used for a Password

In plain English: MD5 and SHA1 are fast hash functions. Password hashes need to be slow, so an attacker cannot try billions of guesses quickly. MD5 and SHA1 are also unsalted by default, which makes them cheaper to crack.

Why it matters: If a password database leaks, fast unsalted hashes can be reversed or cracked at scale.

Bad

return md5($password);
return sha1($user->password);
return hash('md5', $password);

Good

$hash = password_hash($password, PASSWORD_DEFAULT);

if (password_verify($password, $hash)) {
    // Password is correct.
}

password_hash() adds a salt and uses a deliberately slow algorithm. password_verify() checks the password without re-hashing it yourself.

What the rule checks

• md5($password) and sha1($password)
• hash('md5', $password) and hash('sha1', $password)
• Password-like variables or properties used as the hashed value

When it does not report

• The value is not password-like, such as a file checksum.
• The code uses password_hash().
• The code uses a different hash algorithm. This rule only reports MD5 and SHA1.
• The digest is computed in a helper whose name contains sign or hmac, such as generateSignature(). This avoids flagging API request signing.

How to fix

• Use password_hash($password, PASSWORD_DEFAULT).
• Use password_verify() to check a password.
• Rehash old hashes with password_needs_rehash() when users log in.
• Do not use MD5 or SHA1 for passwords, even with a salt.

Model limits

• Password detection is based on variable and property names.
• Signature-helper detection is based on the function or method name. A password hash inside a helper named signPassword() would be skipped.
• Other weak password schemes, such as a single round of SHA-256, are not reported by this rule.

Configuration

E0057 has no configuration options and is enabled by default.

This site is open source. Improve this page.