Re: How to validate passwords without storing them anywhere.

On Wed, Mar 17, 2021 at 3:48 PM Rob Berendt <rob@xxxxxxxxx> wrote:

If I roll my own it won't be licensed.

Time and time again, cryptography experts have tried to stress that
cryptographic security is hard to get right, even for experts. It is
WAY, WAY, WAY too easy for amateurs to throw something together that
"looks good to them" but is actually quite weak in the face of a
professional attack.

You gave a fairly silly example:

If I have these hex codes in DSPPFM
0122DF02DAB6856F42E4EF0BA8
08CE2F055E9100FEF3B661B953
And, even if you knew the word being stored is 'VALID',
just how likely is it to figure out the encryption key used in this process?

For you and me, not bloody likely. For a professional attacker, very
likely. Everything that you and I can come up with amount to
obfuscation (or security through obscurity), not cryptographic
security.

Do you even know what salting is? You didn't say anything about that,
even after Calvin mentioned it twice.

There are libraries out there for cryptographic security built by
professionals. Use them. If you're worried about licensing (or,
generally speaking, even if you're not), choose one that's open
source.

John Y.