Tell me more ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.
up vote 0 down vote favorite

I want to store user's password details in Database. My project is in Java. I want to know the best way of storing passwords and other inportant information like user

share|improve this question
1  
Use this mindrot.org/projects/jBCrypt – dchest Oct 18 '12 at 10:44
Thanks a lot for the solution. But I want the solution which is well defined standardized API. like Apache etc., please provide me API for that standard, on which I can trust as per industry standards – NullPointerException Oct 19 '12 at 4:46

1 Answer

up vote 4 down vote

A lot depends on your threat model, your system setup, etc. Do you require mutual authentication? Are connections secured with SSL or a similar protocol?

For passwords scrypt or bcrypt would be the way to go. They are better than just a simple salt + password setup. It has been recommended by someone worth trusting (our very own @ThomasPornin) that bcrypt might be a better choice right now. If you do require mutual authentication, using SRP (and simply storing the authenticator in a locked down database) would be a very good option.

For storing other user information, it really depends on your requirements (and even laws in your country of residence). The US has laws for storing credit card numbers, health care related information, etc. Do you require that the data be kept confidential even if someone steals the disk? If so, full disk encryption would be one solution. If you only require that no unauthorized entity can read the information, then locking down your database with good access control policies would probably be sufficient.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.