1
$\begingroup$

I am new here and new to encrypting and securing passwords, so please forgive me if this question is not posted to the right location or if my question is bad.

I have been working on a web app in Java that requires a username and a password. Through my research, I discovered that I need to salt and hash my password in order to make sure it is secure when I place it in a database.

So far, I am leaning towards using PBKDF2 with SHA512, but bcrypt is still on the table.

I came across this post about using PBKDF2 for encrypting passwords: http://howtodoinjava.com/security/how-to-generate-secure-password-hash-md5-sha-pbkdf2-bcrypt-examples/

The example seemed to show what I needed to do as far as hashing and salting my passwords, but I was concerned with using a colon to create a split between the iterations, salt, and password.

Wouldn't that just give clues to someone who would try to hack my database as to how I was hashing my passwords?

I know the author of the article was demonstrating how to verify the password using the split method, but I'm thinking this isn't the best method of encryption and verification

What I am hoping for is if someone could take a look at this and let me know if there is a better way (or example) to use PBKDF2 for password hashing and verification. If there are links or other questions that could be suggested, that would be awesome.

Also, I am open to hearing others thoughts on which algorithm I should be using because there is a lot of information out there and it seems like there is nothing conclusive as to which one is the best.

I really appreciate any help that is provided, and I hope this is the right place to post this question.

Thanks!!

Improve this question
$\endgroup$
1
  • $\begingroup$ If you're hoping to keep anything about the method secret after a compromise, then you should just replace standard-password-hash with [standard-password-hash]-then-encrypt. ​ ​ $\endgroup$
    – user991
    Apr 8, 2017 at 5:47

1 Answer 1

Reset to default
1
$\begingroup$

The example seemed to show what I needed to do as far as hashing and salting my passwords, but I was concerned with using a colon to create a split between the iterations, salt, and password.

Wouldn't that just give clues to someone who would try to hack my database as to how I was hashing my passwords?

The security only has to come from the algorithm and the key used, keeping the algorithm or its parameters secret should not be necceasary. That is the principle of Kerckhoff, on of the pillars of modern cryptography. This means in consequence, that since you are using an algorithm considered secure, it is no problem to show the public parameters to an attacker.

Also, I am open to hearing others thoughts on which algorithm I should be using because there is a lot of information out there and it seems like there is nothing conclusive as to which one is the best.

PBKDF2 is fine, but it is not as resilient to attacks with specialised hardware as other schemes. SCrypt is the most well established such algorithm. Another scheme worth mentioning is Argon2. It is the recent winner of the academic Password hashing competition, but due tp its newness it is not as widely used (and implemented) as SCrypt.

Improve this answer
$\endgroup$
4
  • $\begingroup$ Thanks for your thoughts! I did read about Argon2, but there we $\endgroup$
    – Perdue
    Apr 8, 2017 at 13:37
  • $\begingroup$ Sorry! My first comment got cut off because I got distracted.Thanks for your thoughts! I did read about Argon2, but there were a lot of people that advised against using it until it's been out there for at least 5 years. Since it's only in its infancy, I'm still a little hesitant to use it. Do you know of any scrypt implementations of java out there? I tried to find one through GitHub, but it seemed like the one I found had their repository updated years ago which makes me nervous to use it. $\endgroup$
    – Perdue
    Apr 8, 2017 at 13:43
  • $\begingroup$ BouncyCastle includes SCrypt. $\endgroup$
    – mat
    Apr 8, 2017 at 21:52
  • 1
    $\begingroup$ Also note that it may be a smart idea to opt for bcrypt rather than scrypt if you intend to use the hash server-side for many clients. $\endgroup$
    – SEJPM
    Apr 9, 2017 at 13:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.