Re: Authentication in webapp.

John B. Matthews wrote:
In article <7m0774l312ludch0q1v1q3o6sovl4n1dt2@xxxxxxx>,
David Segall <david@xxxxxxxxxxxxxxx> wrote:
The user logs in with a user name and password and the password is put
through an MD5 hash then encoded into base64. The resulting string is
compared against the string stored in the database when the user first
registered. The actual password is not stored in the database and is
only in the computer's memory while it is being entered and encoded.
The MD5 hash is included in java.security and the base64 encoding is
from Mikael Grev's MiGBase64
<http://sourceforge.net/projects/migbase64>.

Presuming the name and password arrive unmolested, one goal is to prevent unauthorized use of the passwords by someone who can obtain a copy of the data. Using MD5 alone in this context has known limitations:

<http://en.wikipedia.org/wiki/MD5>

You can mitigate this effect somewhat by using a suitably chosen salt:

<http://en.wikipedia.org/wiki/Salt_%28cryptography%29>

I'm not aware of any security benefit to base64 encoding.

A different salt for each user + SHA256 hashing should be pretty good.

Arne
.

Relevant Pages

  • Re: Authentication in webapp.
    ... The actual password is not stored in the database and is ... The MD5 hash is included in java.security and the base64 encoding is ... home dot woh dot rr dot com slash jbmatthews ...
    (comp.lang.java.programmer)
  • Re: Authentication in webapp.
    ... The MD5 hash is included in java.security and the base64 encoding is ... I'm not aware of any security benefit to base64 encoding. ... A different salt for each user + SHA256 hashing should be pretty good. ...
    (comp.lang.java.programmer)
  • Re: Authentication in webapp.
    ... I'm using Spring Framework 2.5 as the application framework, ... database and Tomcat respectively. ... The MD5 hash is included in java.security and the base64 encoding is ...
    (comp.lang.java.programmer)
  • Re: Extract image dimensions (height, width) from Base64 String?
    ... You have said yourself that you take an image and convert it into Base64. ... *OR* the server file system) through multiple previews, ... and then finally input it into a database once the preview is accepted ... and then place it into both the image and a hidden input. ...
    (microsoft.public.dotnet.languages.vb)
  • Re: sample for base64 encoding in c language
    ... looking for ("sample for base64 encoding in C language"), ... ** MIME Base64 coding examples ... As the WSO2 is an open source company our project is also an open ... about ten built in algorithms which is to used at the fast infoset. ...
    (comp.lang.c)