Hello Security Experts!
I am implementing a small web application where users can cast votes. On the one hand, I want ballots to by anonymous. So the username is not stored with the ballot. But on the other hand I want that each user can verify for himself, that his vote was accounted for. So I thought about this process:
When a user casts a vote, then he must enter his password. (Of course his password is never stored directly anywhere!) The backend creates a HASH value of the users password. And only that hash value is stored with the ballot. All ballots are publicly available, including their hashes.
So when a user wants to verify that his vote was accounted for, then he can simply recreate his hash value and look it up in the list of public ballots.
Initially I thought about MD5 but then I found that there are stronger, better Hash algorythm. Now i use BCRYPT.
But the Java implementatin of BCRYPT needs a new seed value everytime you want to hash a password. I found out that JBCRYPT stores the seed together with the hashed password.
=> Is that ok? Is that normal? => Could I create one initial seed once, store that and then reuse the same seed value everytime a vote is casted? Or would that be a security risk.
Why do I need that? My functional requirement is a little different than with normal password hashing. When checking a hashed password then you know where to look: Does that specific hash value (at that user) fit the provided password. My requirement is different: The user has a password. When this password is hashed, is the the hash value then contained in a list of hash values.
How can I implement this?