encrypt storage

[Richard Gaskin]

Bob Sneidar wrote:

 > No I am encrypting the password using the encrypt command before
 > storing it in mySQL.

Does the system handle authentication, or is it just storing the 
password for some other system?

If the password will be decrypted on the server (as Mark Wieder is 
probably typing a reply to this as I'm writing <g>) if the server is 
compromised then all of the passwords become compromised along with it.

It seems more common to never store any passwords on a server system, 
instead storing only a (preferably salted) hash of the password 
(hopefully something stronger than LC's built-in sha1; Mark Smith's lib 
contains a function for sha256).

Incoming passwords are then hashed with the same salt to determine a 
match to the server store, and discarded from memory once authenticated.

This way if the server is compromised it'll take serious effort to 
reproduce the passwords.  With sha1 it can take a little as 49 minutes 
(see first link below), and with sha256 it may take years.

The downside to this approach is that passwords can only be reset, but 
never recovered.

The upside to this approach is that passwords can never be recovered. :)

Whenever I come across a system that lets me recover a password instead 
requiring me to reset it, I stop using it immediately.


Scary background on encryption, hashing, and crack times:

<http://www.geek.com/news/researcher-cracks-sha-1-hashes-for-2-10-with-amazons-cloud-service-1295926/>

<https://www.bentasker.co.uk/blog/security/201-why-you-should-be-asking-how-your-passwords-are-stored>

<http://arstechnica.com/security/2013/05/how-crackers-make-minced-meat-out-of-your-passwords/>

<http://stackoverflow.com/questions/6776050/how-long-to-brute-force-a-salted-sha-512-hash-salt-provided>


PS: There's a request for sha256digest in the RQCC:
<http://quality.runrev.com/show_bug.cgi?id=14223>

-- 
  Richard Gaskin
  Fourth World Systems
  Software Design and Development for the Desktop, Mobile, and the Web
  ____________________________________________________________________
  Ambassador at FourthWorld.com                http://www.FourthWorld.com