Mailing-List: contact user-help@shiro.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@shiro.apache.org
Received-SPF: neutral (athena.apache.org: local policy)
Date: Wed, 13 Mar 2013 17:57:22 -0700 (PDT)
From: NabbleReallySucks <bigtrashcaninthesky@yahoo.com>
To: user@shiro.apache.org
Message-ID: <1363222642037-7578379.post@n2.nabble.com>
In-Reply-To: 
 <CAAtvD4VqpSFWi_70THHKZMP0i=W-g6nHunAJHqQOK24hVJcPng@mail.gmail.com>
References: <1363217587346-7578370.post@n2.nabble.com>
 <CAAtvD4XWcY=Lba6_eE0puH4Lm2Lgrit+ZEy__pTm8RUDSFwL9A@mail.gmail.com>
 <CAAtvD4VqpSFWi_70THHKZMP0i=W-g6nHunAJHqQOK24hVJcPng@mail.gmail.com>
Subject: Re: Question on hashing and cryptography. Not able to login
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

Thanks. Our code would do 

Key key = cipherService.generateNewKey();

    ByteSource encryptedPassword =
cipherService.encrypt(accountSecurity.getPassword().getBytes(),
key.getEncoded());
    accountSecurity.setSaltValue(new String(key.getEncoded()));
    accountSecurity.setPassword(encryptedPassword.toBase64());

    accountService.save(accountSecurity);

So I was assuming that each and every saved password would have a different
key anyway. And we would save that key as the salt value.


Our app will be for real money gambling, so it has to pass the standards
committees rules. So I don't think SHA256 is enough to pass. So I guess I
can implement my own matcher that decrypts using the Aes Cipher class.

Thanks

Mark


--
View this message in context: http://shiro-user.582556.n2.nabble.com/Question-on-hashing-and-cryptography-Not-able-to-login-tp7578370p7578379.html
Sent from the Shiro User mailing list archive at Nabble.com.