I have stored encryption keys on the database that are encrypted with a passphrase. To decrypt it the owner/user must login using his passphrase, and that will be used to decrypt the encrypted keys on the DB. My concern is, to verify whether the entered passphrase of the user is the right one, I would have to store a hashed version of his passphrase. Will there be any security issue or is it enough to stop atleast most of the basic attacks. FYI, the system will only have like 2-3 users therefore I am really worried that they could brute-force the stored hashed passphrase.

  • Add a unique random salt to the password before hashing it with at least a sha2 hash. This makes a brute force attack more difficult if an attacker gets into the database.
    – rjdkolb
    Commented Jun 13, 2017 at 18:07
  • 1
    @rjdkolb Not a good idea, for the same reason we don't use SHA2 to hash other passwords. It's too fast to protect against dictionary attacks.
    – Xander
    Commented Jun 13, 2017 at 19:31
  • 1
    Why do you need a hash exactly? Couldn't your program just attempt to decrypt the user's data with the passphrase provided? If it succeeds then the passphrase is correct.
    – John Wu
    Commented Jun 13, 2017 at 20:11

2 Answers 2


We can make use of MAC(Message Authentication Code) rather than just storing the hash of the passphrase in the DB.

MAC Generation

Once the key is encrypted, MAC is generated. We follow Encrypt-then-MAC mechanism.

You can generate a tag = MAC(m, k) where

  • m is the encrypted key
  • k is the key you use for encrypting the users' key (passphrase)

This tag is then stored in the DB instead of the hash of the passphrase.

Checking Passphrase

To check if the passphrase is correct or not, we can easily verify it by generating the MAC again in a similar way, with the key as the passphrase from the user. Now, the generated tag and the tag stored in the DB are checked, if they are equal.

If equal, it is a valid passphrase and the decryption of the encrypted key can proceed. Otherwise, we can throw a message to the user that the passphrase is incorrect.

MAC Algorithms

You can use HMAC (Hash based MAC) from OpenSSL for handling the tasks of MAC tag generation. Appropriate bindings would be available for whatever language you are using in your app.

edit: Make sure that a strong hashing algorithm like SHA256 or SHA512 is chosen for HMAC generation (and not MD5 or SHA1 as shown in the examples in the above link)


If this is implemented as a service rather a file accessible to the users then the client doesn't need to see the hashed password - verification is done on the server. And you can track and respond to multiple failed login attempts. Hence there is little risk from the users.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .