Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have an application with a user database. The database stores the password using a bcrypt hash with a randomized salt.

How can I implement a password history set (to prevent password reuse) in a case like this?

If I have the traditional 3 field password reset (enter current, enter new, confirm new) I could store the current one as I replace the old with the new. However, then I have the case of a forgotten password. My users could go and do an self-service auto reset and reuse their passwords over and over again.

The stored passwords would be encrypted, but with reversible encryption making them less secure.

share|improve this question

2 Answers 2

up vote 6 down vote accepted

Store the old salt and hash values. Hash the new input with any old salts and see if they match.

If it worked for checking the password when they logged in normally, it will work for checking if the password has been used before too.

share|improve this answer
1  
wow, I completely over-thought this one. –  Snowburnt Dec 31 '13 at 15:29
    
@Snowburnt - yeah, we all do that from time to time. Glad I could help. –  AJ Henderson Dec 31 '13 at 15:48

If password1 = password2, then hash(password1, salt1) = hash(password2, salt1).

In other words:

  • Bcrypt the new password with the same salt and iteration count.

  • Compare the hashes.

  • If the new hash is different from the old hash, then everything is okay (according to your criteria), and you can simply re-hash the new password with a new unique salt and store it in the database.

  • If the new hash is the same, then the new password is the same as the old password. Tell your user to choose a new one.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.