title: How to securely generate SSHA256 or SSHA512 hashes in PHP?
body: <p>I am working on a <a href="http://drupal.org/project/mailadmin" rel="nofollow">web administration module for mailservers</a> (it's open source if you'd like to take a look).</p>
  
  <p>For that, I need to be able to generate hashed password that is readable by <a href="http://dovecot.org/" rel="nofollow">Dovecot</a>. As <a href="http://wiki2.dovecot.org/Authentication/PasswordSchemes" rel="nofollow">described on their wiki</a>, their recommended password hashing scheme is SSHA256 (the extra S is for salted).</p>
  
  <p>It's also explained that this could be reasonably simple to implement with something like this PHP code:</p>
  
  <pre><code>$salt = 'generate_a_salt_somehow';
  $hash = hash('sha256', $password . $salt);
  </code></pre>
  
  <p>However, from what I've read about cryptography, that is a rather naíve way to generate salted hashes, but if you're doing it wrong when <a href="http://chargen.matasano.com/chargen/2009/7/22/if-youre-typing-the-letters-a-e-s-into-your-code-youre-doing.html" rel="nofollow">typing A-E-S in your source code</a>, I figured the same could be true in this case.</p>
  
  <p>So if you have insight into cryptography, I'd love to hear about the most secure way to do this, be it mcrypt, mhash or whatever.</p>