--- Gordon Stewart <[EMAIL PROTECTED]> wrote: > im just wondering, im going to design a security system - where > someone needs to log-in with a URL containg MD5 hashed sequence... > > im wondering, how many combinations can there be > > I think there are always 32 characters - But does it contain numbers > 0-9, A-Z and a-z > > Any other characters ? > > From that, I can calculate how many billion billion combos... > > Basically, > im extracting someones email address, adding a 10 character sequence - > Then hashing it with MD5.. > > (the 10 character sequence can be added in several different > combinations (& inter-woven with the email) - Hopefully 10+ > combinations, auto-rotating....) > > Dont worry, Ive thought it through - & its working, I just need the > "base" number of combinations.... > > Thanks... > > -- > G
There's a lot of detail in the Wikipedia page on md5: http://en.wikipedia.org/wiki/Md5 It appears that the output is 32 characters with possible values of [0-9a-z]. Hence your math is something like: p = 36^32 p = 6.33402867 × 10^49 A 6 followed by 49 zeros. In reality, it is probably a smaller number because of the limited inputs. Since md5 is case sensitive (think of Unix passwords) and email addresses are not case sensitive by definition, you will want to be sure that your email addresses are processed to a consistent case (eg strtolower()). Otherwise, your md5 hashes will be different for different inputs: [EMAIL PROTECTED]: 1aeffb4a35de64179c4f26629fc45b94 [EMAIL PROTECTED]: 55502f40dc8b7c769880b10874abc9d0 [EMAIL PROTECTED]: 5ebc89c983be213ec68adde3d4b49566 This may get more complicated when the proposed non ASCII characters are allowed in new domain names. The strtolower() function is localized to the server and these new domain names may appear in emails defined with a different localization. James
