Assume a website where people log in with their password.
The password is now stored in sql database as:
md5(password + random_salt)
We are adding the possibility for clients to stay logged in and I am trying to find out the best way to do that.
- Passwords should stay stored in the DB as hashes using some hash function (with the use of a generated salt) - first hash
- When client logs in with his password, a different hash of his password should be generated (using the previously generated salt) and stored in the relation "second hash".
- These two hashes should be comparable to each other, so that I could check if the second hash (generated during login) originates from the same string as the first one (generated during registration).
The second hash (the "login" one) would also be used to generate a key to encrypted sensitive user files (probably using AES, or is there a better option?).
I am quite new to this and I'm not sure if I am not being too naive, so I am asking. Is there a way to achieve this? Is there any source where I could read about these "comparable hashes"? I tried searching but I don't really know what to look for.