从md5（）切换到crypt（）

So far I have been using md5 to hash passwords on my site, no salt.

Now I am building an application that will have to be more secure and I'm reading md5 can be easily brute-force attacked.

So I want to use crypt() to hash the passwords.

What I have not fully understood is:

1. Do I have to provide a salt or is the built-in generated one ok?
2. How many times (if more than one) should I iterate the crypt function to be safe?
3. With md5, no matter the length of the input string, the hash was 32-digit. Does crypt return a standard length of hashes too?

You need to provide a salt, if you want to specify encryption other than DES. Otherwise, you're good with the default salt.

You don't iterate the crypt function yourself, this is done internally with algorithms where it makes sense. Number of iterations is specified via the salt.

Yes, the hash length of a given hash algorithm is standard; different hash algorithms have different hash lengths, however.

crypt can use different hash algorytms. With md5 it returns 128 bit integer (with 32 chars hex representation). Using crypt with a salt once is safe enought. It's recommended the salt to be provided by the application

An optional salt string to base the hashing on. If not provided, the behaviour is defined by the algorithm implementation and can lead to unexpected results.