1

How do I hash the password for a keystore? How do I then use the hash to retrieve something from keystore? Similarly, how do I use a hashed password for accessing the database?

I have encrypted the password and stored the key in a keystore and I understand that this is not good design and better solution is to store the password in a hashed way and then use that.

Not sure how that is useful after it's hashed, i.e. how to compare and allow authenticated access?

1 Answer 1

1

You don't. The entire point of hashing is to render the original difficult (hopefully very difficult) or impossible to recover. Hashing is used for storing credentials that will be checked by a server. The server gets the password in plain-text (over an encrypted connection) and then hashes it to see if it matches the hashed password it has on record for the user, this way, if the server is compromised, the entire database of passwords is not immediately available to the attacker.

Things like DB passwords and passwords to access other services would have to actually be stored encrypted, but unhashed. Alternately and preferably, services could be asked for an authorization token (such as how oAuth or many other APIs work) that would allow for a particular client to access for that account, but not allow general access to the account.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .