1
$\begingroup$

When a user registers, a random personal salt is generated. Then hashing is done like so:

hash(hash(USERNAME . PEPPER . PASSWORD) . PERSONALSALT)

Then the personal salt is encrypted using password as key and placed in the database along with hash. When user attempts to log in, personal salt is decrypted, and used to hash and compare. Is this a good idea? The hashing function is SHA-256 iterated roughly half a million times depending on sever specs.

Yes I am aware that "rolling your own encryption" is a mortal sin. I am just wondering hypothetically if it would function. I would never use something made sketchily in a production environment.

Improve this question
$\endgroup$
3
  • $\begingroup$ And what is the reason not to use one of well known and accepted methods? You are putting your security at risk for no gain at all $\endgroup$
    – axapaxa
    Jan 12, 2017 at 1:56
  • 2
    $\begingroup$ What is the point of the encryption step and how is it done? (You should merge your accounts so you can comment here.) $\endgroup$
    – otus
    Jan 12, 2017 at 5:39
  • 1
    $\begingroup$ Which hash is iterated half a million times? In your scheme there are two, again highlighting that a semi-formal description is needed. $\endgroup$
    – Maarten Bodewes ♦
    Jan 12, 2017 at 8:17

1 Answer 1

Reset to default
4
$\begingroup$

No it is not a good idea as a password cannot be directly used as a key. You would need a PBKDF (password based key derivation function) with a salt and work factor to create a reasonably secure key out of a password. But that leaves us with a problem: you are trying to create exactly such a function - password hashes and PBKDF's are largely synonymous.

If you do not derive a key correctly then the decryption may leak information by which you can retrieve your password even without going through the iterations. If padding oracles apply during decryption in your scheme then the resulting implementation would be very weak, to name just one issue.

The salt does not require confidentiality in PBKDF schemes, so encrypting it should not disallow any attack.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.