How to verify encrypted passwords with user input passwords in the database?

Question

I am creating a program in which the user will put the login and password before entering the system,and after he put his input,the passwords will be saved in the database,and then I will check if the encrypted passwords match the user inputs.

Example :

The user has typed :

username : 123456

password : 123456

And after this, :

username : E10ADC3949BA59ABBE56E057F20F883E

password : E10ADC3949BA59ABBE56E057F20F883E

After this will be saved in the database,but there I want to check when the user re-enter the same password,check if it is equal and matches the generated hash.

I am making this program that generates the hash in Java and will be used in html,.

How can I do this ?

Answer 1

I’ll use the following. I write the user password in hash form and when I will validate this password I will hash the user input and compare this input hash with what is stored in the database

Validation using a function, I did the example on Oracle. the function receives the password and login (which will surely be unique in its table) Voce passes the password already applied the hash to the function and it returns 0 to false and 1 to true. Here I compare the encrypted passwords.

CREATE OR REPLACE FUNCTION FN_VALIDAR_ACESSO(P_SENHAASH IN VARCHAR2, P_LOGIN IN VARCHAR2) RETURN  NUMBER IS
V_RETORNO NUMBER(1);
V_CONTADOR NUMBER(2);
BEGIN

SELECT COUNT(*) INTO V_CONTADOR 
FROM PCEMPR 
WHERE USUARIOBD = P_LOGIN 
AND SENHABD = P_SENHAASH;

IF V_CONTADOR = 0 THEN
V_RETORNO := 0;-- 0 PARA FALSE
ELSE
V_RETORNO := 1;-- 1 PRA TRUE
END IF;



RETURN V_RETORNO;
END;

His Code :

Create procedure funcaoValidar
@username
@password
as 
begin
declare @existe int
set @existe = (select count(*) 
              from armazenarSenhas 
              where username = @username /*usar operador AND, virgula nao funciona..*/
              and password = @password)
if @existe > 0
print 'Login válido'
else
print 'Não há nenhum login válido'
end

Answer 2

Since your hash generation algorithm generates the same values when applied over the same parameters, you can compare the encrypted user input with the encrypted bank value.

So according to your example when the user 123456 inform your data on the login screen you must make the comparison:

if ((meuGeradorDeHash(nomeUsuarioInformado) = nomeJaCriptografadoNoBanco) &&
    (meuGeradorDeHash(senhaUsuarioInformada) = senhaJaCriptografadaNoBanco)) {
    // login válido
}

Answer 3

Complementing the answers, if your project is not specifically the hash generating algorithm, it is best to leave this function to specialized libraries, see Digestutils.

import org.apache.commons.codec.digest.DigestUtils;
...
String digest = DigestUtils.sha1Hex(data);