Should I encrypt my password after I hashed it? If so how to properly do it?

user_7494877 0
Viewed 1480

I am trying to get a better understanding on Hashing and Encryption, however I stumbled upon questions that I can't seem to find in Google because Google keep offering basic difference of Hashing and Encryption, which I already read.

More over a lot of people ask in StackOverflow which have no idea about the difference between encryption and hashing gets to the top of the SO's search engine. Which doesn't answer my questions, and didn't help me. So I wanted to make sure a few things about hashing a password and encrypting one.

Now let's say I wanted to secure a new registered user..

  1. I need to filter it first. (Skipped because of unrelated)

  2. After I get a 'safe' form of the password, I hash it.

    $safePassword; // Already filled with safe password. $hash = password_hash($safePassword,PASSWORD_ARGON2I);

  3. Then insert it to database.

Now this is the where questions rises.

  1. Do I still need to encrypt the hashed password?

  2. If so, how do I securely encrypt the password? (I'm going to use AES)

AES_ENCRYPT(str, key_str);

Where str is the String that we wanted to encrypt and key_str is the encryption key.

Another question rises

  1. How do I keep the key_str safe, so I can use it for further use (for authentication)?
argon2-ffi aes passwords encryption php
2 Answers

You don't need to encrypt the password, just running it through your password hash, like you included in your question, is perfectly fine. Hashing is a one-way operation, so it is "impossible" to reverse the hash and get the original password.

Encrypting passwords after hashing them doesn't make things any less secure, it just doesn't really make things any more secure either. It also introduces more problems - where to keep the key?

Stick to just Argon2, anything further is unnecessary.

user_17185540

Now let's say I wanted to secure a new registered user..

  1. I need to filter it first. (Skipped because of unrelated)

If by "filter", you mean somehow altering this password.... no! Not only do you not need to do this, you're actually causing yourself a real headache later on down the road, and reducing the security of the password.

Now this is the where questions rises.

  1. Do I still need to encrypt the hashed password?

No. Hashing is a one-way function. You cannot recover the password from its hash. (You could use a rainbow table, which is effectively a list of passwords that result in certain hashes. That's what a proper salt helps prevent.)

There is nothing gained by encrypting this hash.

Another question rises

  1. How do I keep the key_str safe, so I can use it for further use (for authentication)?

This is actually a key reason the encryption isn't useful. To use it, you would need to decrypt it, which means keeping the keys around in the same place as the hash data in the first place.

user_3625360
Related