Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Are there any security problems with following authentication protocol?

when user creates hers account, she provides her username and password. I store the username and blowfishEncrypt(toEncrypt = username, key = password) (lets call it token)

and then when user wants to login, i simply create token again (she needs to provide username and password) and compare the two.

The idea is to not have passwords stored in the database. But i guess i'm relying on the fact that if i know original and encrypted value, i'm not able to obtain the password.

Is there something obviously wrong with this approach?

share|improve this question
3  
That's exactly how password hashing works. –  Polynomial Dec 13 '12 at 12:32
add comment

2 Answers

up vote 8 down vote accepted

The problem is that the encryption operation is rather efficient and thus passwords can be efficiently bruteforced. Its better to use existing standards which do exactly what you're describing but in a safe (and often already implemented) way, like in http://en.wikipedia.org/wiki/PBKDF2

share|improve this answer
add comment

It's called "salt" and was introduced in the 1980s or so for Unix encryption. It's better though to use existing encryption protocols. Mistakes are easy to build in and an audit very complicated.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.