6

Im using php and I was looking to store passwords in a mysql database. I was wondering what would be safer to use a salted hash or openssl encryption? If i use a unique random generated salted hash for each user and store the salt on the database, is there a way someone can find out the salt and decrypt it? Or if I use the openssl_public_encrypt function to encrypt the password using the public key is this safer then using a salted hash?

Aaron Holland
  • 63
  • 1
  • 4

2 Answers2

14

Generally hashing and encryption are for two different things. The main distinction in your case is that hashing is one way, and encryption is two-way. That is, you can decrypt the password to get them in plain text, but you cannot "de-hash" something.

If your system gets compromised and you are using encryption, the attacker will probably have all the information needed to decrypt all the passwords. This is obviously not good. If you hashed the password, even if the attacker got access to the hashed password and seed, they could not get the plain-text password.

For this reason, it's better to hash the password instead of encrypting it. Of course, this assumes you are doing the hashing correctly. Look into something like bcrypt to do this for you.

Oleksi
  • 4,809
  • 2
  • 19
  • 26
  • Thanks for clearing that up. So what exactly is encryption used for? – Aaron Holland Jun 01 '12 at 19:28
  • 3
    In general, hashing is for maintaining integrity, while encryption is for maintaining confidentiality. So you would use encryption to make sure that nobody can intercept and read your data while it's being transfered between two places. In the case of storage, you want the thing you use to be one-way, so that's why encryption is not appropriate. – Oleksi Jun 01 '12 at 19:31
3

You should hash the password using scrypt, bcrypt, or PBKDF2.

There's a lot of advice on this site on exactly this topic. Search for "password hashing" and you'll find it.

See, e.g., How to securely hash passwords?, Which password hashing method should I use?, Most secure password hash algorithm(s)?, Do any security experts recommend bcrypt for password storage?.

You want to use a password hashing algorithm that is as slow as you can stand, to prevent offline dictionary attacks on people's passwords if your database is compromised.

Search the site and you'll find lots more.

Community
  • 1
D.W.
  • 98,420
  • 30
  • 267
  • 572
  • I started using bcrypt to hash my password that way I can alway just change one number and make it slower if i feel its not slow enough. – Aaron Holland Jun 03 '12 at 15:50