I'm in a situation where I need to calculate a hash of the result of the password in plain text plus some random chars representing a session. The gained hash will be compared to another hash that is received by the opponent. The problem is, that I only get the full hash from the opponent which can only be regenerated (or rebuild) with the plain text password.
What is the best practice in this situation? I thought of a algorithm such as AES for saving passwords in a persistent storage to decrypt it later but since I'm operating with the plain text passwords, it might not be very secure and another aspect would be the fact that I operate with sensitive information at this point. Salting seems also impossible.