salt

How would you add salt to your existing password hashes?

由 Deadly 提交于 2019-12-03 16:37:11
问题 I have a database of hashed passwords that had no salt added before they were hashed. I want to add salt to new passwords. Obviously I can't re-hash the existing ones. How would you migrate to a new hashing system? 回答1: Sure you can. Just add a salt to the existing hash and hash it again. Of course this will require any future logins to go through the same process meaning two hash functions will need to be called but lots of legitimate patterns do this anyway so it doesn't smell as bad as you

How long should a salt be to make it infeasible to attempt dictionary attacks?

由 谁说我不能喝 提交于 2019-12-03 16:14:13
问题 I'm designing an authentication system that works like the following: User enters password Salt is generated. Password is hashed with whirlpool Whirlpool hashed password concatenated with the plain salt The concatenated version is hashed with sha1 and stored in the database. I check the password is correct by hashing the password on the application layer, and then doing this (in MySQL): MySQL WHERE `Password` = SHA1(CONCAT('$hashedPassword',`Salt`)) AND [..] At the moment my salt is 64 bytes.

is a GUID a good salt? is my register/login process got any flaw?

由 十年热恋 提交于 2019-12-03 15:44:21
问题 If my table inside the database look like: userid uniqueidentifier username varchar(20) password varbinary(max) When the user submit(to register), I send the user/pass to a stored procedure. The stored procedure create a new GUID(Using NEWID()) then I use the HashBytes(sha1) function of SQL Server to create the password based on the GUID+password provided then I insert the values into the table above. When the user submit(to login), I send the user/pass to a stored procedure. The stored

WildFly: randomly salted passwords in Java EE application

由 拟墨画扇 提交于 2019-12-03 13:51:05
问题 What is the WildFly (8.2) way to work with randomly salted passwords stored in a database? Is an implementation of org.jboss.crypto.digest.DigestCallback (in the password validation process) meant to have access to the salt part from the database? Or should I simply hash and salt passwords by my self before handing them over to the login method of HttpServletRequest ? 回答1: It looks to me like the 'WildFly way' to deal with passwords is to do what most containers do and deliver a non-secure

How to stock and use a shiro's salt from database

由 蹲街弑〆低调 提交于 2019-12-03 13:00:29
问题 I use shiro in application for the authenticate. I use hashed password with a salt and I store them in my database like this : private User createUserWithHashedPassword(String inName, String inFirstName, String inLastName, String inPassword){ ByteSource salt = randomNumberGenerator.nextBytes(32); byte[] byteTabSalt = salt.getBytes(); String strSalt = byteArrayToHexString(byteTabSalt); String hashedPasswordBase64 = new Sha256Hash(inPassword, salt, 1024).toBase64(); return new User(inName

Spring Security 3: Salting password issue

由 夙愿已清 提交于 2019-12-03 12:24:11
I have got an simple application made in which I am able to register users and authenticate them. I've got the passwords encoded using and successfully able to authenticate them. I am using Spring 3, Spring Security 3 and Hibernate 3 in my application. Now I want to salt their passwords with the ID of the user but I am not able to achieve this functionality. Could someone help me achieve it? I've been trying to do it for quite some time but ain't able to get it done. Here is the code I've got for salting users with their ID and authenticating them. xyz-security.xml <http auto-config="true" use

Email address as password salt?

由 被刻印的时光 ゝ 提交于 2019-12-03 07:40:39
问题 Is it a bad idea to use an email address as the salt for a password? 回答1: EDIT: Let me refer you to this answer on Security StackExchange which explains a lot of details about password hashing and key derivation. Bottom line: Use a secure established password hashing scheme that is somehow resource-intensive to protect against brute-force attacks, but limit the number of permitted invocations to prevent denial-of-service (DoS) attacks. If your language library has a function for it, verify on

Web Application - Storing a Password

由 流过昼夜 提交于 2019-12-03 07:40:13
问题 Have I missed anything? Are there any additional steps storing passwords to the DB? Storing the Password: After as much research on the subject as possible I've come to the conclusion that the best way to store user passwords in a web application DB (in my case MySQL+PHP) is as follows: Assign a sitewide static salt. (16 rand chars incl 0-9,a-z,A-Z,[]/*-') Assign a per user random salt (stored in the DB). Store the result hash_function($userPassword + $sitewideSalt + $randomSalt) Store the

How would you add salt to your existing password hashes?

由 ￣綄美尐妖づ 提交于 2019-12-03 05:55:08
I have a database of hashed passwords that had no salt added before they were hashed. I want to add salt to new passwords. Obviously I can't re-hash the existing ones. How would you migrate to a new hashing system? Sure you can. Just add a salt to the existing hash and hash it again. Of course this will require any future logins to go through the same process meaning two hash functions will need to be called but lots of legitimate patterns do this anyway so it doesn't smell as bad as you might think. Salting a password is an effort to defend against rainbow tables. In this case the salt does

AES 256 bit encryption - java.security.InvalidAlgorithmParameterException: Wrong IV length: must be 16 bytes long

由 喜欢而已 提交于 2019-12-03 04:03:35
Below is my encryption logic. Although my IV is 16bytes long, I still get an error with invalid IV length. Would appreciate any help @Override public String encrypt(String dataToEncrypt, String IV) throws Exception{ if(encryptionKey.length() < 10){ encryptionKey = generateEncryptionKey().toString(); } System.out.println("number of IV bytes is "+IV.length()+" "+IV); Cipher cipher = Cipher.getInstance(encrpytionAlgo); SecretKey key = new SecretKeySpec(encryptionKey.getBytes(Charset.forName("UTF-8")), "AES"); cipher.init(Cipher.ENCRYPT_MODE, key,new IvParameterSpec(IV.getBytes(Charset.forName(
订阅 salt