I am using this tutorial and trying to understand and implement salted password hashing using Java. After spending some time on this topic, I figured out that the basic idea is to:
- Convert the password string to a character array.
- Generate a random salt using SecureRandom(or similar).
- Hash the password character array with a standard cryptographic hash function.
- Convert the salt and hash byte arrays to respective hexadecimal strings.
- Prepend the hexedSalt to hexedHash and save the resulting string along with the hexedSalt to the database.
- What's the point of prepending the constant
- Is my understanding of the whole process correct?
- Here is the link to my source code - which value should I save as hash and which value as salt?