By "encrypting" passwords you are violating CWE-257: Storing Passwords in a Recoverable Format. But this is exactly what the French government wants. They want to be able to obtain the passwords of any user. By all accounts this is bad thing, and Bruce Schneier agrees.

So how can you satisfy this French mandate as well as maintaining a high level of security?

  • @Rook - StackExchange websites are not meant for "open discussion" threads. Please review the FAQ, as well as this post on the StackExchange blog: blog.stackoverflow.com/2010/09/good-subjective-bad-subjective The question should be re-formulated so that it is seeking to find an objective solution to a real-world problem.
    – Iszi
    Commented Apr 10, 2011 at 2:08
  • @Iszi okay it is a real world problem (websites with french users), and it has a definitive solution.
    – rook
    Commented Apr 10, 2011 at 2:41
  • See also this discussion over on SO, from a year ago... quite heated, in fact, and I'm glad to see none of the same rhetoric (yet) that there was over there. It's funny, some of the highest voted answers are just plain wrong, and all those that spoke to common sense and reasonable risk analysis were strongly downvoted (e.g. mine, near the bottom :) )
    – AviD
    Commented Apr 10, 2011 at 8:54
  • @AviD♦ I remember that post, and I completely agree. I even say in my profile that the correct answer is almost never chosen. That is why you should test everything, and exploit is a form of a test.
    – rook
    Commented Apr 10, 2011 at 21:25
  • Heh, but in this case I was arguing against the veracity of any exploit based test, instead a conceptual risk analysis was called for. Also, if I'm not mistaken, you were in agreement with the accepted answer there ;)
    – AviD
    Commented Apr 11, 2011 at 5:18

5 Answers 5


Don't force yet-another-password on your users. Use PKI, hardware tokens, or some other method like OAuth or OpenID that leverages some Identity Provider site which sits outside of whatever jurisdictions you're worried about.

Note that the actual requirements of the 2004 French law in question Loi pour la confiance dans l'économie numérique aka Act on Confidence in the Digital Economy are not clear and it seems that some reporting has misinterpreted or exaggerated the effects. For example it sounds like it may be sufficient to simply provide law enforcement with some other access to the user's account, e.g. for a child pornography investigation, in a way that doesn't tip the user off that their account is being accessed (as a typical password reset would).

  • 3
    @Rook, no he's not - in his solution, there are no passwords, to store or not store. The French law (I assume) does not require every website to have passwords, only to store existing passwords in a recoverable format.
    – AviD
    Commented Apr 10, 2011 at 8:55
  • 4
    @rook If the OpenID Identity Provider uses passwords to authenticate its users, it presumably just needs to be outside of the jurisdiction and thus not subject to the jurisdiction's laws. But of course OpenID IdPs can also use other non-password-based authn. And check the refs on "French Law" some more - this whole thing seems to be a misunderstanding.
    – nealmcb
    Commented Apr 10, 2011 at 13:22
  • 2
    @rook, we certainly welcome lawyers here since policy and compliance are major aspects of IT Security. And the question as posed refers to compliance with a law, so what the law means is very relevant.
    – nealmcb
    Commented Apr 10, 2011 at 18:58
  • 2
    @nealmcb, and dont forget, this is a technical law with security implications, so the lawyers should have been welcoming us over there, too...
    – AviD
    Commented Apr 11, 2011 at 5:22
  • 1
    @rook, Hmmm. Why do you think that a server in Virginia with French users would be affected by this French law? Do you have a citation for how French law would apply, if your organization has no legal or physical presence in France? We agree that PKI is one solid solution, and OpenID and OAuth can each be based on PKI with no passwords on any servers.
    – nealmcb
    Commented Apr 11, 2011 at 19:31

Use Public Key Cryptography. Your server will only have the public key. This will allow the server to encrypt a password and then can compare cypher text in order to authenticate a user.

The private key should be on a drive inside a bank vault. If the french government demands a password, then you can access to the private key to decrypt the password.

  • This is a big improvement on hackable passwords. But it does not protect users (even users outside the jurisdiction) against abuse of legal authority which can still get their password. If there really were jurisdictions which required plain text password storage, I wouldn't trust them to not abuse the law to get them when they wanted them.
    – nealmcb
    Commented Apr 10, 2011 at 13:26
  • 1
    You can only compare ciphertexts if you are using deterministic encryption with no randomness. This is not advisable since it will not be secure against chosen plaintext attacks (or chosen ciphertext attacks).
    – PulpSpy
    Commented Apr 10, 2011 at 15:53
  • 1
    @nealmcb Yeah I see what you are saying. I agree, France is evil.
    – rook
    Commented Apr 10, 2011 at 18:07
  • @PulpSpy I'm not sure what you are saying, you can still use a salt, and the same plaintext+public key will always produce the same cipher text.
    – rook
    Commented Apr 10, 2011 at 18:08
  • 1
    Why do you say France is evil? The BBC got it wrong, it seems, and I haven't seen a really good analysis yet of how France differs from most other governments in this respect.
    – nealmcb
    Commented Apr 10, 2011 at 18:54

This questions has been debated, in one form or another, for some time as the "key escrow" problem. There are fundamental problems with the architecture of giving a third party access to secured data. These are invariant to how you implement the cryptography. See this article for example.

I am interpreting the question as how to provide third party access to secured data: the debate about whether this actually corresponds to the current situation with the French government I'm considering tangential; and there are unsolvable risks with doing this by the nature of the problem. So consider this answer as making the best of a bad situation.

A set of requirements could be:

  1. The server has access to all the records
  2. The government can be granted access, but only to specific records
  3. It should be fairly efficient to register a new user
  4. It should be very efficient to authenticate a user
  5. It doesn't necessarily have to be that efficient to recover a record

There is actually a very nice solution to this problem with very modern cryptographic techniques, called functional encryption, however it is not efficient. With these types of schemes, the server can hold a master private key that allows them to decrypt any record and they can create a new private key that can only be used to decrypt specific records. This solves (1), (2) and (5), conflicts with (3) and does not provide (4).

In order to provide (4), I'd suggest a hybrid system where whatever existing password-based authentication system is being used is continued to be used to do (4), and it is augmented with an encryption of the user's record (including the password). If the record is provided to the government, once it has recovered the password, it can compare ensure it is the same password being used to authenticate the user.

An alternative to using function encryption would be for the server to encrypt the record with an appropriate encryption scheme that allows them to generate a "zero-knowledge" proof of what the record is each time the government asks for a record (instead of giving the private key). The proof could be encrypted during transit to the government (and one could even use a "designated verifier" proof to stop the government from sharing the proof with others).

None of these solutions will ever solve the fact that the government needs to be trusted not to abuse its authority, since protecting against this conflicts with the definition of the problem we are trying to "solve."

  • 1
    +1, although I really dont think we should be looking at crypto to solve access control...
    – AviD
    Commented Apr 11, 2011 at 5:25

Using PGP, there's no need to store a password. User signs up by submitting their public key. When they need to sign in, send the user some random text, have them sign and return it. Then verify their signature to authenticate them.


Store it twice. Once using PKI with a private key that isn't easily accessible and once using a non recoverable format, this way if you have to comply with a legal request you have a method to do so and you can use standard best practices for day-to-day authentication.

  • The security of such system is basically the weakest link. You might as well not bother with saving it in non-recoverable format and simplify your system with just the PKI-encrypted password.
    – Lie Ryan
    Commented Jul 30, 2014 at 12:24
  • @LieRyan How so? You wouldn't be able to validate the password with just the public key so dumping the non-recoverable format means that the web server needs access to the private key which you could otherwise keep air gapped from the internet. This in turn means that you are much more vulnerable to a compromised web server or internal threat.
    – Yaur
    Commented Aug 1, 2014 at 22:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .