PHP: Safe way to store decryptable passwords

Posted by Jammer on Stack Overflow See other posts from Stack Overflow or by Jammer
Published on 2010-03-31T19:50:18Z Indexed on 2010/03/31 19:53 UTC
Read the original article Hit count: 232

Filed under:

security

|

password-encryption

|

passwords

|

password

|

php

I'm making an application in PHP and there is a requirement that it must be possible to decrypt the passwords in order to avoid problems in the future with switching user database to different system.

What encryption/decryption algorithm would you suggest? Is it good idea to just store the encrypted value and then compare the future authentication attempts to that value? Are the passwords still as safe as MD5/SHA1 when the private key is not available to the attacker (Hidden in USB drive for example)? I should still use salting, right?

What encryption libraries should I use for PHP?

© Stack Overflow or respective owner

Related posts about security

sudo apt-get update errors

as seen on Ask Ubuntu - Search for 'Ask Ubuntu'
Here is what I get on my terminal when running sudo apt-get update errors. I dont know if the issue is from my sources.list or my proxy setup(have not made any changes to proxies). Thank you for any help in advanced. Ign http://security.ubuntu.com oneiric-security Release.gpg Ign http://security… >>> More
The Security-Developer Gap: Why IT Security Can't Fix Your Security Problems Alone

as seen on Devx - Search for 'Devx'
Two well-known white hats explain how hackers take advantage of security holes left by enterprise application developers. >>> More
The Security-Developer Gap: Why IT Security Can't Fix Your Security Problems Alone

as seen on Internet.com - Search for 'Internet.com'
Two well-known white hats explain how hackers take advantage of security holes left by enterprise application developers. >>> More
StackOverFlowError while creating Mac object on AS400/Java

as seen on Stack Overflow - Search for 'Stack Overflow'
Hello all, I am a newbie to AS400-Java programming. I am trying to create my first program to test the implementation of Message Authentication Code (MAC). I am trying to use the HMACSHA1 hash function. My (Java 1.4) program runs fine on a dev box (V5R4).But fails terribly on the QA box (V5R3). My… >>> More
Google App Engine - Spring Security Issue (java.security.AccessControlException)

as seen on Stack Overflow - Search for 'Stack Overflow'
I'm currently getting the AccessControlException below when I deploy to app engine (I don't see it when I run in my local environment). I'm using GAE 1.3.1, Spring 3.0.1, and Spring Security 3.0.2. Any ideas how to get around this issue? It appears to be an issue with Spring Security trying to get… >>> More

Related posts about password-encryption

Password encryption/ decryption code in .NET

as seen on Stack Overflow - Search for 'Stack Overflow'
I want simple encryption and decryption of password in C#. how to save the password in encrypted format in database and retrieve as original format by decryption, kindly anyone help with sample code. >>> More
Facebook Connect and Hash Password Encryption

as seen on Stack Overflow - Search for 'Stack Overflow'
I'm trying to integrate a Zen Cart site with Facebook Connect. So far, I've been able to get Zen Cart to recognize that the user has a facebook account and is logged in, but that's it. True authentication into Zen Cart eludes me because I can't figure out where a password could be stored and how to… >>> More
convert password encryption from java to php

as seen on Stack Overflow - Search for 'Stack Overflow'
I'm trying to create a PHP version of an existing JSP program, however I'm stuck at the password encryption part. Could you please tell me how to convert this one? I know it tries to get the md5() but after that, I don't get it. I get lost in the Stringbuffer and for() parts. Can you help me out… >>> More
SYBASE :: FINDING SERVER PASSWORD ENCRYPTION PROPERTIES

as seen on Stack Overflow - Search for 'Stack Overflow'
1 how can i find whether server is accepting encrypted password or not from C program using sybase library(encryption set by sp_configure "net password enryption reqd",1), to make sure whether i should call function ct_con_props (CS_SEC_EXTENDED_ENCRYPTION) or not >>> More
Finding server password encryption properties

as seen on Stack Overflow - Search for 'Stack Overflow'
1 how can i find whether server is accepting encrypted password or not from C program using sybase library(encryption set by sp_configure "net password enryption reqd",1), to make sure whether i should call function ct_con_props (CS_SEC_EXTENDED_ENCRYPTION) or not >>> More