password-encryption | 易学教程

How to use scrypt to generate hash for password and salt in Python

阅读更多关于 How to use scrypt to generate hash for password and salt in Python

问题 I would like to use scrypt to create a hash for my users' passwords and salts. I have found two references, but there are things I don't understand about them. They use the scrypt encrypt and decrypt functions. One encrypts a random string and the other encrypts the salt (which looks wrong since only the password and not the salt is used for decryption). It looks like the decrypt function is being used to validate the password/salt as a side effect of the decryption. Based on the little I

Password Hashing PHP 7 [closed]

阅读更多关于 Password Hashing PHP 7 [closed]

I am currently learning PHP and I have been looking through the forum for current thinking on how best to Hash passwords in PHP. Can anyone advise on what is currently the best password hashing method to use. I have been told about PHPass, but are there better alternatives in 2017? Thank you for any advice, Ian Jay Blanchard You should never encrypt passwords, you should only hash them. Encryption implies that you can decrypt the password into a human readable form. You should never do that. Hashing is a one way street and once hashed a password cannot be recovered in human readable form.

Encrypt and Decrypt iOS/Node.js Security Inquiry

阅读更多关于 Encrypt and Decrypt iOS/Node.js Security Inquiry

I'm currently using AES128 on both platforms and my code from this answer Note: I changed the code a bit to deviate from using an IV because I thought it was overkill for the purpose of my application. node.js: var CryptoJS = require("crypto-js"); var crypto = require('crypto'); var password = "1234567890123456"; var salt = "gettingsaltyfoo!"; var hash = CryptoJS.SHA256(salt); var key = CryptoJS.PBKDF2(password, hash, { keySize: 256/32, iterations: 1000 }); var algorithm = 'aes128'; console.log(key.toString(CryptoJS.enc.Base64)); function encrypt(text){ var cipher = crypto.createCipher

How to decrypt AES encrypted file with '-nosalt' param

阅读更多关于 How to decrypt AES encrypted file with '-nosalt' param

问题 I'm new to encryption. This question is subquestion of my previous one. I have a file encrypted with OpenSSL util: openssl aes-256-cbc -in fileIn -out fileOUT -p -k KEY I'm using this code to decrypt it: byte[] encrypted = IOUtils.toByteArray(inputStream); Security.addProvider(new BouncyCastleProvider()); String password = "abc"; Cipher c = Cipher.getInstance("AES/CBC/PKCS5Padding", "BC"); // Openssl puts SALTED__ then the 8 byte salt at the start of the // file. We simply copy it out. byte[]

Correctly using crypt() with SHA512 in PHP

阅读更多关于 Correctly using crypt() with SHA512 in PHP

All the examples online show the use of crypt like this: $pass = crypt('something','$6$rounds=5000$anexamplestringforsalt$'); But everyone says that you are not supposed to define the rounds or the salt. So how should I use it? Also I am having a problem: when I run the code above, it only runs 50 rounds instead of 5000 rounds as if the system is stopping it. Any help will be greatly appreciated. //- Solution -// I have found some of these to be useful: For generating Salt: $salt = substr(str_shuffle("./ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz012345‌6789"), 0, 8); or if you have a

Password encoding and decoding using Spring Security, Spring Boot and MongoDB

阅读更多关于 Password encoding and decoding using Spring Security, Spring Boot and MongoDB

I use the mentions software stack above and I need to encrypt password before save into database. I also need to decrypt password because when someone will change password he she needs to give in the old password and then the new onw twice and I need to check the old password. I have searched a lot but I still not sure what is the right way to do this. I have found this link Encrypting but are there other hints to do this? I also not sure if maybe MongoDB provides something to protect passwords. Ralph First read Steven Carlson´s answer about password hashing. The good thing is that Spring

Safe way to store decryptable passwords

阅读更多关于 Safe way to store decryptable passwords

I'm making an application in PHP and there is a requirement that it must be possible to decrypt the passwords in order to avoid problems in the future with switching user database to different system. Consider that it's not possible to modify this future system's password method and I need plain text passwords in order to have the passwords generated. The plan is to encrypt the user's password with a public key that is stored on the server. Authentication is done by encrypting the input and comparing the results. There is NO decryption done. The private key capable of the decryption is stored

Preferred recoverable method to store passwords in database

阅读更多关于 Preferred recoverable method to store passwords in database

问题 I want to store some passwords on my database at server. The passwords should be recoverable, since I want to use them for a third-party api which needs the password. (So I can't use one-way methods like md5...) What is the best method to save passwords in database? Isn't there any better way than storing plain text? 回答1: AES is cryptographically sound and probably the most common encryption (as opposed to hashing) mechanism selected for new applications. Take care to generate a random

How to use password to decode a string?

阅读更多关于 How to use password to decode a string?

I have one password which needs to be travelled across network. So for the safety side I have encoded from transmitting end and doing decoding at receiving end. But my friend still able to breach password on the network because he know that how I have encoded the password string. Here is my code package org; import java.util.Base64; public class EncodingString { public static void main(String[] args){ String str = "I'm Encoding then decoding"; byte[] bytesEncoded = Base64.getEncoder().encode(str.getBytes()); System.out.println(bytesEncoded); String EncodedPassword = new String(bytesEncoded);

Does AES/CBC really requires IV parameter?

阅读更多关于 Does AES/CBC really requires IV parameter?

I am writing a simple app to encrypt my message using AES / CBC (mode). As my understanding CBC mode requires IV parameter but I don't know why my code work without IV parameter used. Anyone can explain why? Thanks. The encrypted message printed: T9KdWxVZ5xStaisXn6llfg== without exception. public class TestAES { public static void main(String[] args) { try { byte[] salt = new byte[8]; new SecureRandom().nextBytes(salt); SecretKeyFactory keyFactory = SecretKeyFactory.getInstance("PBKDF2WithHmacSHA1"); KeySpec keySpec = new PBEKeySpec("myPassword".toCharArray(), salt, 100, 128); SecretKey tmp =