How can you ensure that the password you stored is well encrypted using php and mySql

Questions

Note: I am a student and I need this in a project of my own

http://stackoverflow.com/questions/16645656/how-to-encrypt-password-using-php-script http://stackoverflow.com/questions/16645656/how-to-encrypt-password-using-php-script

My question is: should I store encrypted password into the database and decrypt it once someone logs-in and check if they are alike?

Also, should I use some other security layer on database to ensure that the data is safe? Some MySql self encryption or something like that?

I need a basic encryption that could do this. I know there are several threads about this, but my question is how to do this and if it would be useful to secure the data in the database as well (triggers, functions, etc) or not.

Answers

Don t save encrypted password, instead store a hashed version.

Use an algorithm such as PBKDF2 (Password Based Key Derivation Function) with a random salt and a reasonably large iteration count to slow down the hashing. Then when you want to check a password run the password through the same hash function and verify the result matches the saved hash.

Note: save the salt and iteration count along with the resultant hash, none of these are need to be secret.

Source

License : cc by-sa 3.0

http://stackoverflow.com/questions/34159962/how-can-you-ensure-that-the-password-you-stored-is-well-encrypted-using-php-and

Related