How to decrypt the hashed password of pbkdf

Question

I am trying to do a project where I hashed the password and store hashed password in database.

Now I am facing problem in decrypting. How can I decrypt this pbkdf form of password? I am trying to do this in Java.

Answer 1

where I hashed the password and store hashed password in database.

Nice job! But, how did you accomplish this?

How can I decrypt this pbkdf form of password?

Impossible. That's the point.

There are only 2 operations a password hashing library should be exposing. Going back to the original question ( HOW did you hash those passwords?), if the API of your library doesn't work like this, it's a crap library, find something else.

The 2 primitives are:

String encodeNewPassword(String password);

boolean verifyPassword(String passwordEnteredByUser, String thingThatEncodeNewPassReturned);

And the procedure is simply to invoke encodeNewPassword when you have a new password (a new account signup, or a user changed their password), take the string or byte[] or whatnot that this method returns, store the whole thing in a database someplace, and then retrieve that and pass it back when you need to verify later that the user entered 'their' password: You pass in the password the user just entered together with the thing you stored in the database and you get back a 'yes' or a 'no'.

The salt and hash are all baked into this one string.

At best, the createNewPassword call also lets you configure tolerances or difficulty (for example, if we're talking bcrypt, perhaps how many 'rounds' you want).

You didn't say which library you are using, but it is highly likely that it works as above (again, as I said, if it does not, get rid of it , it is bad), so go hunt for 'the other method', the one that takes in both a password as entered by a user and the string that you got before and returns a boolean to indicate whether it's right or it is wrong.

Note that this method, internally, is not decrypting anything. It's salt/hashing the entered password in the same way and is checking if the same hash comes out. If they are equal, the user entered the same password as they did before.

Answer 2

Hashing is a one way function , decrypting of hash is not possible. You can compare the text by hashing and then compare the hash in database if it is original or not.

Answer 3

To check logins, you hash the user input and compare it with the hashed password.

If your hash is not repeatable (same hash for same string) then you're doing it wrong - ie, you chose the wrong hashing method.

For salted hashes, you need to store the salt with the hashed password, and use the same salt to hash the user input you're checking.

Answer 4

PBKDF is not encryption. As the same suggests it's a password based key derivation function. It's a hash but purposely slow. Short answer: you can't. The whole idea of PBKDF is to make it hard to find a collision. Even if you knew how many rounds were used, it would still take too much time to get a collision