cryptographypasswordspassword-hashpassword-storage

Is saving a private key encrypted with the users password safer than storing a hash in a database?


Is storing a private key generated by the client that is encrypted by the users password safer than storing a hash of a password? (The encryption part is done client side and it will be sent to the server the users password won't be sent to the server)


Solution

  • It depends what you're talking about.

    If i'm the client:

    What you've done is have the client create a strong password with extra steps. I can convert those bytes to a string:

    4uG,crh9N%=T99g6'oc36o&+AF9.IDo.oV_DFre)

    This is now the user's "password". When they login to your site, you need to validate that password. That means that you must securely store that password in your system - and taking the SHA-256 hash of that password is not secure.

    That's all if the client encrypts it

    What if instead the user generates a "private key":

    58 3b ae a9 de 37 88 e6 ed a2 9f 45 db 8b 9f 56 ef e1 aa 25 ac 52 f6 3d 02 dd 1b 86 1f c5 39 44

    And they send that to the server, and you will encrypt it with the user's password: how did you know the user's password!?

    You can't do that, because you can't know their password.