How to activate MD5 passwords?

[bjmg]

$passwort = "||||:". crypt(stripslashes($user["user_passwort"]), "$1$".md5(time()) );
}

This is NOT more secure than a true md5 with a correct salt.
By the way: a crypt salt only consists of two (2) chars. Don't forget that.
Like this one (not tested - sorry):

$passwort = "||||:". md5("$1$md5(time())."$".stripslashes($user["user_passwort"]));

A correct salt for md5 has a length of 12 chars and 8 of those 12 chars should be random. A salt always starts with $1$ and ends with $.
So this is a correct salt "$1$xxxxxxxx$".
I'll provide a patch that uses correct salts. Just look into it or even better look into some description of md5 in passwd/shadow files.

Bernhard

[till]

I'll provide a patch that uses correct salts.

Thanks.

Just look into it or even better look into some description of md5 in passwd/shadow files.

I've not written that code. I will have a look into it.

[bjmg]

Above I wrote md5(). I actually meant to use the md5 version of crypt. I also verified that your md5 encryption works but in general random data is better for encryptions than time data. It seems that PHP5 does not care about the missing $ at the end of the salt. And it does not care about the too long salt. But I think you really should use a right length/right formed salt.

Bernhard