1
$\begingroup$

I am trying to develop a Rest API using Kotlin/Spring Boot. The JSON request in it, should have a hashed password that was done using Argon2id. Getting the password hashed was pretty straight forward and simple enough! But I am stumped at how to verify what I receive in the JSON request is correct or not. That is matching it with a plain string. This is how I am achieving the hashing.

val argon2PasswordEncoder = Argon2PasswordEncoder(64, 256, 4, 10240, 4)

val hashedPassword : String = argon2PasswordEncoder.encode(decryptedPassword)

println(hashedPassword)

Now I can store the plain text password in a Kotlin string and match it against the hashed password but that probably beats the point of encryption in the first place, I guess!

The other option I was thinking was probably to encrypt the plain text password using some other algorithm (lets say, I use Jasypt) and storing it in the database. And then decrypting it when I get the request, and matching it with the hashed password I receive. But that seems to be a bit of stretch and probably a bad design too! Because from what I see there is encode() method in Argon2PasswordEncoder, but nothing to decode, it back to a string. There is matches() method. But leads me back to the question on my mind. How do I store the plain text password?

Can you please let me know, what is the best way to do this? Was Argon2 a bad choice from the get-go? Or just my lack of knowledge.

Any pointers would be helpful. Thanks!

Improve this question
$\endgroup$
5
  • 1
    $\begingroup$ Argon2 has no built-in cooperation with a decryption algorithm. Usually, It receives the clear password for generating hashedPassword at password enrollment, and for verifying hashedPassword at password verification. At the cryptographic level, Argon2 is used the same at enrollment and verification. If there's a difference, it's in the handling of salt (typically generated at enrollment, and extracted from a password token at verification). That's API-dependent, thus rather a programming question, and rather off-topic. $\endgroup$
    – fgrieu ♦
    Sep 27, 2022 at 9:11
  • $\begingroup$ @fgrieu So from what I understand, Argon2 is beneficial when during login webpages and stuff like that when a user is entering a password in plain text? $\endgroup$
    – hell_storm2004
    Sep 27, 2022 at 10:30
  • 1
    $\begingroup$ Yes. For that purpose, "Entering a password in plain text" includes doing this with transfer of the password encrypted over https, or/and with the actual password characters visually replaced by *, or/and with use of a virtual keyboard. Argon2 is not Password-Authenticated Key Exchange/Agreement. $\endgroup$
    – fgrieu ♦
    Sep 27, 2022 at 11:21
  • 1
    $\begingroup$ @fgrieu I found this completely practice of how to store and verify password hashes. This has nothing to do with our site. Also, OP needs to learn the difference Can I say "I have encrypted something" if I hash something? and Differences between hash- and encryption algorithms? $\endgroup$
    – kelalaka
    Sep 27, 2022 at 16:59
  • $\begingroup$ The usual way to use your API is: on enrollment, compute hashedPassword from password in clear as you did, and store that. On verification of alleged password, supply it in clear and hashedPassword to matches. If this is what you have been asking, this is off-topic, and the best course of action is that you remove the question. If not, please edit to clarify ! $\endgroup$
    – fgrieu ♦
    Sep 27, 2022 at 17:12

1 Answer 1

Reset to default
1
$\begingroup$

Verifying password using a password hash requires the user to provide the password in plaintext.

If you use HTTPS (i.e. HTTP over TLS), this shouldn't be too much a problem.

Alternatively, you can generate random keys (you said it's an API) on your server and distribute them to your users. Some benefit include:

  1. Single use random keys can be revoked without causing denial of service.
  2. Can also be hashed using Argon2 if wanted.
Improve this answer
$\endgroup$
3
  • $\begingroup$ I vaguely understood what you wrote. But I just want to be a bit clear... So you are saying, lets say I have a password "ABCDEF": 1. I generate a Random Key for it and store it somewhere. 2. Then hash it using Argon2. 3. Ask for that hash to be sent across in the API's request. 4. Then when the API receives it, do a match? 5. It should match the random key that was originally created? Sorry, if lost the plot completely! :) $\endgroup$
    – hell_storm2004
    Sep 27, 2022 at 10:36
  • 1
    $\begingroup$ @hell_storm2004 Almost there, except: 1: you don't generate a random key for the password, you just generate a random key; 3: ask for the key to be sent over HTTPS/TLS in plaintext. $\endgroup$
    – DannyNiu
    Sep 28, 2022 at 0:53
  • 1
    $\begingroup$ You can check the document for your favoriate cloud provider for "object storage" services, these often use randomly generated keys for accessing the "storage buckets". @hell_storm2004 $\endgroup$
    – DannyNiu
    Sep 28, 2022 at 0:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.