Tru Dat!
The best way to encrypt (I believe) is to use GravityScore's SHA256 lua implementation. Then generate a random string to be the salt, append that to your password and then save the salt and the hashed password.
Also, MD5 isn't the greatest crptographic hash function…
Okay some corrections are needed here…
Firstly some terminology correction… Encryption != Hashing
Encryption is the obstruction of data using a key that when the key is applied again the data is back to how it originally was. An encrypted string can be variable in size depending on the data even when the same encryption method is used.
Hashing is the process in which a string is transformed into a different unique (ish, depends on the algorithm) string, unlike encryption this process
cannot be reversed. A hashed string will always be the same length, no matter the length of the supplied string, for example if we were to hash "a" using SHA256 it will be a 64 character long string, and if we hash "hello, world" it will also be a 64 character long string.
Okay so now that is out of the way, time for the second correction, your use of salting is wrong. Lets assume we have the following 3 passwords and their respective hash values (not real hash output, I had no desire to type 64 characters to replicate a SHA256 :P/> )
password input: bob1990 —> hash output: AD756GDM8
password input: password123 —> hash output: 835KDBGL0
password input: qwerty —> hash output: SDF89375N
password input: password123 —> hash output: 835KDBGL0
notice how obviously both the passwords "password123" come out the same, now lets assume we have the following salt "er*&34jksdf0". if we apply that to the above passwords in a manner you suggest, this is our outcome
AD756GDM8er*&34jksdf0
835KDBGL0er*&34jksdf0
SDF89375Ner*&34jksdf0
835KDBGL0er*&34jksdf0
notice how that changed literally nothing? … okay well one reason we use a salt is to make sure that dictionary attacks will not work on the passwords, in the case of the above passwords a dictionary attack would actually notice the salt added onto the end of the strings — since all the strings have the same set of characters — and it would remove that from the string, meaning that we're left with just the original pre-salt strings, this means that dictionary comparisons would be no more difficult. So how do we improve this? simple, we add the salt to the password before we hash! by doing that we would then have the output like so (again not real hash values)
password input: bob1990er*&34jksdf0 -> hash output: K4S67FKJ3
password input: password123er*&34jksdf0 —> hash output: SDJH3891J
password input: qwertyer*&34jksdf0 —> hash output: 6KJH2HJ6F
password input: password123er*&34jksdf0 —> hash output: SDJH3891J
so the advantage here is that when it is performing the dictionary comparison of lets say 'password123' which had the result of "835KDBGL0" well now it is actually 'password123er*&34jksdf0' with the result of "SDJH3891J" meaning that the passwords do not match. Now you might say "how do we compare these passwords to the input password, simple just hash the input with the salt and compare the results, if they entered 'password123' with the salt added its output will become "SDJH3891J"
now you might notice an additional problem here, and that is that both of the 'password123' hash values are the same, even after the salt. well this can be a problem 'cause it means even with a salt if they crack one password they can crack all the other ones with the same hash result. commonly this is mitigated by making each password have a unique salt as well, meaning that even passwords that are the same will have different outputs, take this example
password input: "password123" —> salt: "er*&34jksdf0" —> password + salt: "password123er*&34jksdf0" —> hash output: "SDJH3891J"
password input: "password123" —> salt: "23fh*(#HJa42" —> password + salt: "password12323fh*(#HJa42" —> hash output: "AD756GDM8"
notice now how even though they are the same passwords, they're different hashes. now you may have the question "but how do we store those salts so we can use them again for later" and well the simple answer there is, however you want, as long as you store the salt somewhere and know which password it relates to you're fine. the reason for this is the common attacks on hashed passwords is the use of rainbow tables, which is just a bunch of pre-hashed passwords, why? well the process of hashing can take a long time (especially with some algorithms, the longer the better really), so even if you hand them your salt on a silver platter the likelihood of them being able to run through all dictionary values and hash them with your salt to find the match is low — this is assuming that the password is a strong password, which is why companies tell you to do it that way, so there's even less of a chance of them matching a dictionary word — no one would really do this.
however all of this being said, a simple hash in ComputerCraft is more than enough, especially when someone can just break your computer and/or door with a pickaxe.
