Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Possible Duplicate:
Which password hashing method should I use?

I want the best cryptography algorithm for storing passwords in database, which one should I use and how can I implement using java code and please suggest available APIs for the same algorithm also.

share|improve this question
    
I'm low-rep here, so I cannot vote to close directly, but this question has been asked before, fx in security.stackexchange.com/questions/5605/… –  Jesper Mortensen Jan 22 '12 at 10:01
    
@JesperMortensen FYI: You can flag the question for moderator attention. There should then be an option for "it does not belong here", under which you can mark it as an exact duplicate. It won't take effect as an actual vote to close, but it will call a moderator's attention to the issue. Then (as Rory has done here) they can come in and apply the diamond-plated hammer if they deem it appropriate. –  Iszi Jan 23 '12 at 15:56
add comment

marked as duplicate by Iszi, Rory Alsop Jan 22 '12 at 11:01

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

1 Answer

up vote 2 down vote accepted

IMHO the best password storage function is scrypt. This algorithm became my favorite key derivation function after reading Stronger Key Derivation via Sequential Memory-Hard Functions. Scrypt can use an arbitrary amount of memory or cpu time. This feature makes scrypt very difficult to crack using an FPGA or GPU. It should also be noted that ChromeOS uses scrypt in an interesting design.

A java implantation can be found here.

share|improve this answer
    
"IMHO" is exactly why I just voted to close this question. It's subjective, and also time-localized. Not a good fit for SE format. –  Iszi Jan 22 '12 at 9:38
    
Yes the answer is subjective, however I found the references very good, credible and informative. I thank @Rook for the response. –  Eureka Ikara Jan 22 '12 at 9:55
    
@Iszi I agree that this should be closed out of a dupe. But if we where to close every question for being subjective we would make very little progress. –  Rook Jan 22 '12 at 17:17
    
@Rook, I was wondering what your take is on adding a 'pepper' value in addition to a salt for password hashing (independent of algorithm choice). Mainly because you approach the subject from the real-life point of view, rather than the academical side. –  Jacco Jul 19 '12 at 9:13
    
@Jacco, a pepper is a very good idea and it makes password cracking much more difficult. –  Rook Jul 19 '12 at 9:15
show 1 more comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.