Hey sherlock, that didn't answer my question, hence why I asked it again. What purpose does a CMS have with a hashing function?

He's using it for passwords...

I guess one thing you can do is to use the md5() function instead of the hash() one.

@rivereye: Read the whole topic before you reply. Thanks

@Kllr:
Its a Content Management System, its going to use some kind of auth. I can't think of any other reason to use a hash in a cms off the top of my head.

And the MySQL Password() function fails in this regard why...?

I personally have never used it, and therefore not sure how well it would work in keep the passwords safe. This is one of the reasons I started this topic, for suggestions on what hashes are best to use with passwords. I kind of hinted that before, but it was firstly more of a topic to see who could crack my hashes(I enjoyed making them, and wanted to see how well they held up ^^,). No need to snap back, just trying to get my feel for new hash algorithms

So anyway, the MySQL password() function, how well does it work? It always seemed to me like it was "too easy", I guess you could say.

It creates a hash http://dev.mysql.com/doc/refman/5.0/en/password-hashing.html

You don't really need to worry about how crackable the hashes are, as the passwords will be stored on a password-protected MySQL server - ideally that server will be on localhost and will be set up to only allow connections from localhost. Then you just need to make sure you don't have any possible SQL injections (easy if you execute your SQL queries correctly - there are functions built into PHP to sanitize your inputs) and it will be "impossible" to find a hash collision as they don't have (and can't get) the hash. So MD5 will still be perfectly acceptable if for whatever reason you don't want to use the MySQL Password() function (this is, after all, what it was designed and built to do...)

There are plenty of boot code BCALLs that deal with this. Sort by address on WikiTI and look at the 8000h+ ones.

The key is built into the boot code, to recover from certificate screw-ups when trying to receive a new OS.

Sounds good, I'll probably just some variation of the md5() function or both functions if I get paranoid

Just throw some salt into the password when you MD5() it or something.

A good salt is "salt"

@Kerm: I plan to.

I've had a function from the start that automatically made 4 char salt that is unique to each L{CMS} system

Every time you install it, its a different one.

Based on what? You might as well just cat /dev/rand or the PHP equivalent thereof. Oh, and why are you limiting yourself to only a 4-character salt? Have you made progress on this yet?