Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Are there any security problems with following authentication protocol?

when user creates hers account, she provides her username and password. I store the username and blowfishEncrypt(toEncrypt = username, key = password) (lets call it token)

and then when user wants to login, i simply create token again (she needs to provide username and password) and compare the two.

The idea is to not have passwords stored in the database. But i guess i'm relying on the fact that if i know original and encrypted value, i'm not able to obtain the password.

Is there something obviously wrong with this approach?

share|improve this question
That's exactly how password hashing works. – Polynomial Dec 13 '12 at 12:32
up vote 8 down vote accepted

The problem is that the encryption operation is rather efficient and thus passwords can be efficiently bruteforced. Its better to use existing standards which do exactly what you're describing but in a safe (and often already implemented) way, like in

share|improve this answer

It's called "salt" and was introduced in the 1980s or so for Unix encryption. It's better though to use existing encryption protocols. Mistakes are easy to build in and an audit very complicated.

share|improve this answer
It is actually not called "salting." Salting is a different technique where you add random characters to a password before hashing to defeat rainbow tables. – Cort Ammon Nov 29 '14 at 5:52

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.