登录时如何将原始密码与数据库中的加密密码条目匹配

Question

   MessageDigest alg = MessageDigest.getInstance("MD5");
   alg.reset(); 
   alg.update(password.getBytes());
   byte[] digest = alg.digest();
   StringBuffer hashedpasswd = new StringBuffer();
   String hx;
   for (int i=0;i<digest.length;i++){
   hx =  Integer.toHexString(0xFF & digest[i]);
   //0x03 is equal to 0x3, but we need 0x03 for our md5sum
   if(hx.length() == 1){hx = "0" + hx;}
   hashedpasswd.append(hx);
  }

I followed the above code for password encryption. But when login the password checks with database password and login fails as the db entry is encrypted password. How will i check the database's encrypted password with original password on login?

Answer 1

While checking with the database, Hash the password you entered with the same algorithm as the one you used to save it in the Data Base. That's how Hashing works. You don't need to "Decrypt" the password from the database, that's not possible. You would rather want to Hash the password you're entering and check whether both the hash values (ie the one in db and the one you just hashed) are equal. That is the entire concept of hashing. You can't "DeHash" something. You can only hash the coming data and compare it with previously hashed value.

Answer 2

加密（user_entered_pa​​ssword）== getPasswordFromDatabase（）