Chockstone Forum

      Sponsored By
      ROCK
   HARDWARE

Chockstone Photography

Australian Landscape Prints

Chockstone Forum - Chockstone Feedback

Provide Feedback About This Website

Topic Date User

ummm hacked??? 21-Dec-2006 At 3:06:56 AM PensionerPower

Message

On 20/12/2006 gremlin wrote:
>Actually both methods are correct.

No they are not.

When people talk of "encrypting" a password, they generally mean, to encipher the plaintext passwords using a symmetric cipher and a fixed secret key. This is *wrong*, because, anyone who can find that key can instantly decrypt all the passwords into their plaintext forms. No competent password storage scheme should ever let any password be decrypted into its plaintext form.

If you encrypt a password using a symmetric cipher, you should use the password *as* the key, to encrypt a known (public) constant, for example, all-zeros. Then, there is no "secret key" to recover (to decrypt all the other passwords). But this is not what people generally mean when they refer to "encrypting a password".

Best practice is *not* to encrypt passwords *at all*. Instead, salt them & hash them. Salting & hashing is fundamentally different to encrypting.