Authentication without saving password

Question

Are there any security problems with following authentication protocol?

when user creates hers account, she provides her username and password. I store the username and blowfishEncrypt(toEncrypt = username, key = password) (lets call it token)

and then when user wants to login, i simply create token again (she needs to provide username and password) and compare the two.

The idea is to not have passwords stored in the database. But i guess i'm relying on the fact that if i know original and encrypted value, i'm not able to obtain the password.

Is there something obviously wrong with this approach?

Answer 1

The problem is that the encryption operation is rather efficient and thus passwords can be efficiently bruteforced. Its better to use existing standards which do exactly what you're describing but in a safe (and often already implemented) way, like in http://en.wikipedia.org/wiki/PBKDF2

Answer 2

It's called "salt" and was introduced in the 1980s or so for Unix encryption. It's better though to use existing encryption protocols. Mistakes are easy to build in and an audit very complicated.