I've implemented a system for my login page (with php) that will update the password hash and initialization vector (for openssl) on each login. So essentially, every time the user successfully logs in, the initialization vector for openssl is re-created in the following way:
1. generate 16 random bytes. 2. Hash the bytes with SHA256. 3. Store the hash in the database.
For encrypting the passwords:
1. Grab the newly created IV. 2. Cut the IV to a 16-byte-long string using a secret algorithm. 3. Use the shortened IV in the openssl_encrypt function, along with the secret key and plaintext password.
Overall, the password is stored as a
SHA256 hash of the openssl output, and the IV is stored as a
How strong is this method? Does updating the database user credentials increase or decrease the chances of a decryption in any event?