secure password storage

Thread view:

John Diamond - 29 Nov 2003 00:06 GMT

Hi,

I have a MySQL database that's holding username/password credentials for
a Servlet-based web-app I'm working on. My question is: How do I
securely store the password in the database?

Thanks in advance!
John

Reply to this Message

Christian Friedl - 29 Nov 2003 16:12 GMT

> Hi,
>
> I have a MySQL database that's holding username/password credentials for
> a Servlet-based web-app I'm working on. My question is: How do I
> securely store the password in the database?

Compute a hash value from the password and store this password in the
database. Next time the user logs on, he has to enter his pwd again.
What you do is to build again this hash value and compare it with the
one stored in DB. If it's equal...

HTH,
Christian

Reply to this Message

Michael Amling - 30 Nov 2003 00:19 GMT

> > Hi,
> >
[quoted text clipped - 6 lines]
> What you do is to build again this hash value and compare it with the
> one stored in DB. If it's equal...

Are you thinking of sending the password in the clear over the
network? That can be avoided by using SRP. http://srp.stanford.edu/ has
documentation for the protocol, which, if it were me, I would implement
using java.math.BigInteger.

--Mike Amling

Reply to this Message

John Diamond - 30 Nov 2003 02:49 GMT

I went ahead and computed hash value's to store in the database. This
prevents someone who is viewing the user table from seeing everyone's
password, which is what I was seeking to prevent.

Thanks for the help everyone!

>> > Hi,
>> >
[quoted text clipped - 14 lines]
>
> --Mike Amling

Reply to this Message

Abdullah Kauchali - 30 Nov 2003 13:30 GMT

"Michael Amling" <nospam@nospam.com> wrote in message news:qIayb.7660

> Are you thinking of sending the password in the clear over the
> network? That can be avoided by using SRP. http://srp.stanford.edu/ has
> documentation for the protocol, which, if it were me, I would implement
> using java.math.BigInteger.

Hi Mike,

Thanks for that link. One question, though:

Won't the usage of SRP require that passwords be actually stored
(irrespective whether encrypted or not) on the server? (IE. Does SRP
require the plain-text user password, or does it work off the hashed value
of the password on the server to generate the server public key?)

Kind regards

Abdullah

Reply to this Message

Abdullah Kauchali - 30 Nov 2003 14:45 GMT

"Abdullah Kauchali" <abdullah.kauchali@somewhere.com> wrote in message

> Hi Mike,
>
> Thanks for that link. One question, though:
>
> Won't the usage of SRP require that passwords be actually stored
> (irrespective whether encrypted or not) on the server?

:) Okay, don't answer that, just read the protocol details, and apparently

"NOT". Great stuff.

It would be interesting to see any references that demonstrate the
incorporation of Single Signon to OpenLDAP, ActiveDirectory with SRP.

Regards

Abdullah

Reply to this Message

secure password storage

Free Magazines