What are your thoughts on the following code? is it secure enough?
Note: $password is used to represent the secret, which would essentially be a SHA512 hash of
username . password . signupdate(unixtime)
Do you think I'm covered?
Here's a demo for the testing purposes.
error_reporting(E_ALL & ~E_NOTICE | E_STRICT);
ini_set("display_errors", "1");
echo '<pre>';
$break = '<br/>';
$password = trim("password");
echo 'step1 the password is posted<br/>';
echo $password;
echo $break;
echo $break;
$time = date("F j, Y, g:i a");
echo 'step2 get the time in human readable format<br/>';
echo $time;
echo $break;
echo $break;
$salt1 = $time . hash('sha512', (sha1 .$time));
echo 'step3 create salt1<br/>';
echo $salt1;
echo $break;
echo $break;
$salt2 = substr(md5(uniqid(rand(), true)), 0, 25);
echo 'step4 create salt2<br/>';
echo $salt2;
echo $break;
echo $break;
$hash = str_split($password);
echo 'step5 split the password into an array<br/>';
print_r($hash, false);
echo $break;
echo $break;
echo 'step6 hash each charachter of the password in the array<br/>';
foreach($hash as $key => $value) {
$hashed[] = $salt2 . hash('sha512', ($salt . $value)) . $salt . hash('sha256', (salt2 . $key));
}
print_r($hashed, false);
echo $break;
echo $break;
$hashed_2 = implode($hashed);
echo 'step7 implode the array into a single hash<br/>';
echo $hashed_2;
echo $break;
echo $break;
$hashfinal = str_shuffle($hashed_2);
echo 'step8 shuffle the hash to decrease entropy<br/>';
print_r($hashfinal, false);
