111 reputation
2
bio website wrongnotes.blogspot.com
location Atlanta, GA
age 38
visits member for 2 years, 10 months
seen Apr 10 at 19:37

May
20
awarded  Teacher
Sep
24
awarded  Analytical
Jun
7
comment Security implications of storing the password hash along an encrypted AES key
I've re-read Norman's text, and the first bullet point sounds like he IS storing the hashed version of the user's password and it was confirmed in bethlakshmi post. The PKCS#5 standard is only applied to the password used to encrypt the AES key which is derived from the user's password and salt. There are no details about how the user's password is being hashed (algorithm, iterations, etc). I agree bcrypt or scrypt would be a better choice.
Jun
7
answered Security implications of storing the password hash along an encrypted AES key