Are there any security problems with following authentication protocol?

when user creates hers account, she provides her username and password. I store the username and blowfishEncrypt(toEncrypt = username, key = password) (lets call it token)

and then when user wants to login, i simply create token again (she needs to provide username and password) and compare the two.

The idea is to not have passwords stored in the database. But i guess i'm relying on the fact that if i know original and encrypted value, i'm not able to obtain the password.

Is there something obviously wrong with this approach?

  • 3
    That's exactly how password hashing works.
    – Polynomial
    Commented Dec 13, 2012 at 12:32

2 Answers 2


The problem is that the encryption operation is rather efficient and thus passwords can be efficiently bruteforced. Its better to use existing standards which do exactly what you're describing but in a safe (and often already implemented) way, like in http://en.wikipedia.org/wiki/PBKDF2


It's called "salt" and was introduced in the 1980s or so for Unix encryption. It's better though to use existing encryption protocols. Mistakes are easy to build in and an audit very complicated.

  • It is actually not called "salting." Salting is a different technique where you add random characters to a password before hashing to defeat rainbow tables.
    – Cort Ammon
    Commented Nov 29, 2014 at 5:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .