Assuming you store the AES key along side the encrypted output in the same data store (e.g. in the same database row), then this solution (at least, as shown in code below) is probably less secure than a strong hash with a randomly generated salt and a large enough complexity factory (e.g. iterations):
If an attacker were to compromise your data store, they have all the information they need to decrypt the ciphertext to see the raw password (plaintext) value. But if you were using Shiro's standard PasswordService and an attacker were to compromise your data store, the attacker has to go through a lengthy (and computationally expensive) process to try to brute force any single saved value. Again, this is all assuming you store the AES key next to the encrypted output - I don't know your data storage techniques (nor should I! ;)). Also note that the code: accountSecurity.getPassword().getBytes() is platform dependent. You probably want to use Shiro's ByteSource.Util.bytes(accountSecurity.getPassword()).getBytes() which will use UTF-8 encoding. Anyway, perhaps you can achieve what you desire by combining the two techniques: use AES to encrypt the PasswordService's output. Cheers, Les On Wed, Mar 13, 2013 at 5:57 PM, NabbleReallySucks <[email protected]> wrote: > Thanks. Our code would do > > Key key = cipherService.generateNewKey(); > > ByteSource encryptedPassword = > cipherService.encrypt(accountSecurity.getPassword().getBytes(), > key.getEncoded()); > accountSecurity.setSaltValue(new String(key.getEncoded())); > accountSecurity.setPassword(encryptedPassword.toBase64()); > > accountService.save(accountSecurity); > > So I was assuming that each and every saved password would have a different > key anyway. And we would save that key as the salt value. > > > Our app will be for real money gambling, so it has to pass the standards > committees rules. So I don't think SHA256 is enough to pass. So I guess I > can implement my own matcher that decrypts using the Aes Cipher class. > > Thanks > > Mark > > > > -- > View this message in context: > http://shiro-user.582556.n2.nabble.com/Question-on-hashing-and-cryptography-Not-able-to-login-tp7578370p7578379.html > Sent from the Shiro User mailing list archive at Nabble.com.
