I was reading here on Hashes and Salts and I thought about another method to do user authentication. I need your thoughts on this as I might be overlooking something.
For web application authentication, the general trend is to hash the password appending a random salt, with a strong hash function. The random salt and generated hash gets stored in database. Later, when the user wants to authenticate, the user entered password is hashed again with the stored salt and the generated hash is compared with previously stored hash.
Now about my method:
- We store one master secret text (as long as it needs to be) in our database and we use unique salt per user.
- Instead of storing password hash, we symmetrically encrypt (hash(master secret + salt)) using user password as key and store this encrypted value in our database.
- When user wants to authenticate, this previously stored encrypted value will be decrypted using user password as a key and we will get a hash(master secret + salt). This decrypted hash will be compared with newly calculated hash(master secret + salt)
- If user enters a wrong password, the decryption will fail and we will get a wrong hash which will fail to compare against hash(master secret + salt)
In this way we are not storing user password in database in any form (plain text, hash, encrypted). I want to know how this method compares against our usual method of password hashing.