Password encryption; your opinions

neilmasters

Hi all,
im curious as to what encryption methods you use for storing sensitive data. Specifically what I am referring to is passwords within a mysql database.

As some of you may switch between different algorithms depending on the task you are working on, the system requires to be a secure system which can lead to identity theft(sigh I hate using media generated words) and it is a public online system.

This will go into an academic project so any references and sources you can cite, in particular decent ones(eg. well known author) would be brilliant as there is quite a few online discussions, however few academic analytical publications.

Anyway, let the mass arguement of times to cracking, processing power and personal preference begin!

Neil

laserlight

neilmasters wrote:
im curious as to what encryption methods you use for storing sensitive data. Specifically what I am referring to is passwords within a mysql database.

So, you are trying to prevent an attacker who succeeds in compromising the database from using those passwords to say, login to other online accounts of users who reuse passwords?

I'm curious as to whether you need to provide a password retrieval mechanism for your users, or if a "set new password" scheme will suffice. For the former, you really do need encryption, but then you have the problem of storing the secret key such that it will not be compromised along with the rest of the database. For the latter, I suggest using a cryptographic hash algorithm along with a user specific salt. The important factors to look at would be preimage resistance and computation time (i.e., the slower the better to delay brute force attacks).

Besides the storage of passwords, look into the transmission of passwords, e.g., the use of SSL/TLS.

neilmasters

Hrm laserlight poses some good questions. So here they are answered.

1) Yes, the assumption is to prevent someone who has the passwords from cracking them.
- However, there are other factors to play: computation time required of the web server to create new users(i.e. sha1:hash -> input into db). Its a more overall general question.

2) It will be a set new password setup. User enters there registered email address and a new temp password is sent to them, they then have to change password upon login.

Also i suppose the last note is, SSL/TLS is awesome as a discussion point in theory but for the particular project its not really feasable at this moment.