I bought a Canon scanner in 1996. It had a one click email button on it.
I hooked my computer to the net so... does this mean I should really hold the patent?
>Outside of this, no one should be using MD5 in this day and age, I would even recommend against Sha256 and other variants in that family, though I have a lot of respect for Blowfish, etc.
@shanelija SHA-256 is a secure cryptographically secure hash function. It is not and was never intended nor should be used as a key derivation function.
Given time and email are not unique, they should not be used as a salt. Concatenation of a salt is not the correct method either, not for KDF and not for message authentication.
One of the aims of a hash functions is to be fast, really fast, super fast while making it computational infeasible to:
make a message that will hash to a given value
alter a message that when hashed will produce the same or a give value.
Find two different messages with the same hash value.
bcrypt, scrypt, PBKDF2 are perfect for password storage.
YOU are not off the hook yet until you repeat these 2 sentences 10 times:
A secure crypto algorithm/system/function/whatever MUST continue to be secure even if the algorithm/system/function/whatever is public.
It is perfectly fine to homebrew crypto given one key condition, you never ever ever ever use it for things that matter.
I want my time back, three pages on basically nothing.
I broke into my house last year because I lost my keys -> brb writing an article titled "How I became a burglar and locksmith"*
*I took my keys from in the house so... by ars standard that's serious theft.
Rather than reading that article might I suggest having a gander at moxie's https://www.cloudcracker.com and read his blog too for all the goodies.