password-encryption | 易学教程

What API and algorithm to be used to encrypt and decrypt a password using java

阅读更多关于 What API and algorithm to be used to encrypt and decrypt a password using java

问题 I am currently creating application using Java, I googled password encryption with java but the results are so enormous I felt overwhelmed. How would I encrypt and decrypt a password using Java? And what is the best practice for encrypting and decrypting passwords? I am guessing MD5 is not a way to go since it is a one way hash. I am using struts2 as my framework, was wondering if they provide password encryption 回答1: Updated : Try JBCrypt: String password = "MyPassword123"; String hashed =

Best practice of Hashing passwords

阅读更多关于 Best practice of Hashing passwords

I would like to know which method to use to store passwords in database. I have implemented it using MD5 but according to some posts SHA1 is more secure. Is there any other method which is more secure? Please help me finding out a best method to secure passwords. Sure SHA1 is more secure that MD5, but for most purposes it is not secure enough. You will probably find useful the video How NOT to Store Passwords by Computerphile - 9 minutes and 24 seconds long. You must realize that there is much to cover when it comes to authentication and access control, so having a good hashing scheme is not

Best practices: safest method to store passwords in a table? [closed]

阅读更多关于 Best practices: safest method to store passwords in a table? [closed]

I am using PHP. I used to use native mysql function password() to store passwords. I was told that password() is not safe anymore. What would be the best method to store passwords in PHP? is it MD5? Updated Answer 2016: The winner of the PHC (Password Hashing Competion) was Argon2 . Hashing passwords with Argon2 is the best practice as of 2016. PHC ran from 2013 to 2015 as an open competition—the same kind of process as NIST's AES and SHA-3 competitions, and the most effective way to develop a crypto standard. We received 24 candidates, including many excellent designs, and selected one winner

AES-256 Password Based Encryption/Decryption in Java

阅读更多关于 AES-256 Password Based Encryption/Decryption in Java

I found a guide for implementing AES encryption/decryption in Java and tried to understand each line as I put it into my own solution. However, I don't fully understand it and am having issues as a result. The end goal is to have passphrase based encryption/decryption. I've read other articles/stackoverflow posts about this, but most do not provide enough explanation (I am very new to crypto in Java) My main issues right now are that even when I set byte[] saltBytes = "Hello".getBytes(); I still get a different Base64 result in the end ( char[] password is random each time, but I read that it

What way is the best way to hash a password? [duplicate]

阅读更多关于 What way is the best way to hash a password? [duplicate]

问题 This question already has an answer here: Secure hash and salt for PHP passwords 14 answers I'm working on a website that should be very safe for the users, so I need the hash the passwords. Usually I'm using the MD5, but I read that it doesn't safe anymore. So I tried PHPass, but then I read that it also has been cracked. So I tried password_hash() of PHP 5.5, but I use HostGator, and the PHP there is 5.4. Also I want to be able to add salt without knowing it (like time() * userid() ), like

ColdFusion - cfusion_encrypt() and cfusion_decrypt() - C# alternative

阅读更多关于 ColdFusion - cfusion_encrypt() and cfusion_decrypt() - C# alternative

问题 I have a database with user passwords that are encrypted via cfusion_encrypt(). I need to do a login alternative for the ColdFusion code in C#. Is there any easy way how to emulate this in C# so I will be able to compare encrypted values of user passwords and match them to the ColdFusion values? 回答1: The poorly named cfusion_encrypt() is not encryption at all. It is an internal, legacy obfuscation algorithm, whose use is strongly discouraged. Essentially it just xor's the bytes, similar to

Hashing a SecureString in .NET

阅读更多关于 Hashing a SecureString in .NET

In .NET, we have the SecureString class, which is all very well until you come to try and use it, as to (for example) hash the string, you need the plaintext. I've had a go here at writing a function that will hash a SecureString, given a hash function that takes a byte array and outputs a byte array. private static byte[] HashSecureString(SecureString ss, Func<byte[], byte[]> hash) { // Convert the SecureString to a BSTR IntPtr bstr = Marshal.SecureStringToBSTR(ss); // BSTR contains the length of the string in bytes in an // Int32 stored in the 4 bytes prior to the BSTR pointer int length =

Hashing a SecureString in .NET

阅读更多关于 Hashing a SecureString in .NET

问题 In .NET, we have the SecureString class, which is all very well until you come to try and use it, as to (for example) hash the string, you need the plaintext. I've had a go here at writing a function that will hash a SecureString, given a hash function that takes a byte array and outputs a byte array. private static byte[] HashSecureString(SecureString ss, Func<byte[], byte[]> hash) { // Convert the SecureString to a BSTR IntPtr bstr = Marshal.SecureStringToBSTR(ss); // BSTR contains the

Best practice of Hashing passwords

阅读更多关于 Best practice of Hashing passwords

问题 I would like to know which method to use to store passwords in database. I have implemented it using MD5 but according to some posts SHA1 is more secure. Is there any other method which is more secure? Please help me finding out a best method to secure passwords. 回答1: Sure SHA1 is more secure that MD5, but for most purposes it is not secure enough. You will probably find useful the video How NOT to Store Passwords by Computerphile - 9 minutes and 24 seconds long. You must realize that there

Best practices: safest method to store passwords in a table? [closed]

阅读更多关于 Best practices: safest method to store passwords in a table? [closed]

问题 As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance. Closed 7 years ago . I am using PHP. I used to use native mysql function password() to store passwords. I was told that password() is not safe anymore.