如何以标准方式实现身份验证？

Question

I am trying to develop a user authentication for my project. To realize this I have created a table have two columns having username and password. The username is stored as it is, where as the password is encrypted using jasypt.

ie The password entered by the user during registration is encrypted using a encryption key and then placed in the corresponding column.

When the user wants to logging to the application, the program fetch the encrypted password of the same user, the password is decrypted using the same encryption key.

then the decrypted password is then matched with the one that is entered.

Is this the right way of implementing?

I did even found out that there are other ways to implement key and value pair. But I was not able to understand that. Kindly help with the resource. Or some brief explanation

Answer 1

sounds correct :) why change something that's already works? :) the are no perfect security but you did good afford and the are others methods to it but i see no problem with yours(no need for another encrypt).

Android: Encrypt password

http://nelenkov.blogspot.co.il/2012/04/using-password-based-encryption-on.html

http://security.blogoverflow.com/2013/09/about-secure-password-hashing/

no need for another info ;)

Answer 2

The problem of your method is you must take good care of the security of encryption key

This is a mormal way for websites or applications authentication:

During registration use hash algorithm (MD5 is popular before but proved to be unsafe now) to encrypt the password+salt, where salt is a random string. Then store hash value and salt with username.

When a user wants to log in and enter username and password, first add the salt to password and use the same hash algorithm to encrypt it. Then see if the result matches stored hash value.