network profile
| bio | website | wrongnotes.blogspot.com |
|---|---|---|
| location | Atlanta, GA | |
| age | 37 | |
| visits | member for | 2 years |
| seen | May 8 at 21:19 | |
| stats | profile views | 1 |
|
May 20 |
awarded | Teacher |
|
Sep 24 |
awarded | Analytical |
|
Jun 7 |
comment |
Security implications of storing the password hash along an encrypted AES key I've re-read Norman's text, and the first bullet point sounds like he IS storing the hashed version of the user's password and it was confirmed in bethlakshmi post. The PKCS#5 standard is only applied to the password used to encrypt the AES key which is derived from the user's password and salt. There are no details about how the user's password is being hashed (algorithm, iterations, etc). I agree bcrypt or scrypt would be a better choice. |
|
Jun 7 |
answered | Security implications of storing the password hash along an encrypted AES key |
