java - How to encode Jaysypt password -


I currently place my jsypt entry below. Instead of keeping plain text, I have seen in some examples that he uses ENC (G6N718UuyPE5bHyWKyuLQSm02auQPUtm).

  & lt; Bean id = "strong encryption" class = "org.jasypt.encryption.pbe.StandardPBEStringEncryptor" & gt; & Lt; Property Name = "Algorithm" & gt; & Lt; Price & gt; PBEWithMD5AndTripleDES & lt; / Pricing & gt; & Lt; / Property & gt; & Lt; Property Name = "Password" & gt; & Lt; Price & gt; Jasypt & lt; / Pricing & gt; & Lt; / Property & gt; & Lt; / Bean & gt;   

Please provide me the steps to make it ENC (G6N718UuyPE5bHyWKyuLQSm02auQPUtm).

If this is a server-side application, then get all my password related values ​​G6N718UuyPE5bHyWKyuLQSm02auQPUtm The password must be stored in the form of a password hash. You should never store passwords in a password.

In addition, you should not encrypt clear text passwords. The reason for this is that if the attacker exploited your machine, then it is likely that you have an encryption key that you used to encrypt the password. Hashing is safe because you can not 'unhash' the password.

My recommendation:

string password = hashfunk (password + username + salt);

Then store passwords in that way Use SHA-2 hashing for reliable security.

In this way, when you get a password from your client, you have to havehish and compare it.

Comments

Popular posts from this blog

Verilog Error: output or inout port "Q" must be connected to a structural net expression -

jasper reports - How to center align barcode using jasperreports and barcode4j -

c# - ASP.NET MVC - Attaching an entity of type 'MODELNAME' failed because another entity of the same type already has the same primary key value -