I am trying to encrypt and decrypt the data using SHA 5 in mysql. I am able to encrypt the data but unable to decrypt it. How can I achieve the decrption of SHA5 encrypted data in mysql.
What do you exactly want to do ? As Michael says, you will not be able to reverse a hash. We use hash when we want hide the real information and never decrypt it. If you want to decrypt it, then use an inversible function.
Hash algorithms (SHA = secure hash algorithm) are one way. You can use then to verify information such as a password by checking that the password entered, when SHA'd, equals the encrypted version on record. You can't decrypt with it though.
Related
I will take example of my case . I am using PostgreSql .I have gone through postgresql crypt() function documentation .
This function is provided as extension for postgresql .
If i migrate my data to another database by different vendor , Will the passwords still be evaluated properly or not ?.
If i try to compare the the hash generated in postgresql with hashing utilites provided by mysql/mongodb using same source string will it evaluate to be equal or not
According to docs, crypt()
Calculates a crypt(3)-style hash of password. When storing a new
password, you need to use gen_salt() to generate a new salt value. To
check a password, pass the stored hash value as salt, and test whether
the result matches the stored value.
It means if you migrate your data to another database (if stored hash value is part of your data of course), the result of comparison will not depend on the system.
Can you move up the encryption/decryption to the application level? In that case, you can migrate data as encrypted and other database vendor don't need to worry would consider them as normal data?
Another option is to encrypt disk level instead of applying encryption at a database level.
After going through lot of posts it came to me that encrypting at application layer is better . like for example to encrypt passwords in java, we can use jBcrypt library .
I want to implement a system where by encrypted data can be stored alongside everything you need to decrypt it except a human memorable password. The system I have in mind is that the encrypted data would be stored with the key that was used to encrypt that data, only that key would have been encrypted again using the hash of the users password. There would then be another hash of the password also stored in the same place, but this hash would have used a different hash function.
The decryption process would be:
user enters password
the password is hashed using hash function A and that hash is checked against the stored hash to ensure it was correct
if the password was correct, you rehash the given password with hash function B to get Key 1
Key 1 can then be used to decrypt Key 2 which was used to encrypt a block of data
This way you could store unlimited encrypted data, all encrypted using different randomly generated AES keys that are all encrypted by the hash of the password (Key 1). Ideally you could give this block of data to anyone and they couldn't decrypt it without the password. You could also send the password hash and a single block of encrypted data over a network and the end user can decrypt it on their end assuming they know the password.
I know the standard response to these things is don't roll your own, but I would like to know out of interest what the security concerns are for this system. Primarily Could it work and what pair of hash functions should be used and why? I am also interested in what the standard way to achieve this would be.
Okay, I have an extremely basic knowledge on how to make a secure, login system.
If you try to login, you get the attempted password, hash it to example md5, try to match the hashed password with the password stored on some sort of database/server (also hashed).
When registering it stores the md5 hash on the server, but NOT the original. So even if it's breached it's untraceable. (Even though there are services that have a database of hashes, and can attempt to reverse).
My problem is: How to store the hash? If i used a mysql database, it would have the details hard coded inside, and I don't code in php so can't really make an online one.
How would I hide the mysql credentials in my software?
Don't generate your own salts.
Research PHP password_hash and password_verify functions, which do pretty much all you ask, automatically and fairly securely in PHP 5.5+.
http://php.net/manual/en/function.password-hash.php
Also
http://php.net/manual/en/faq.passwords.php
You can also use this on PHP 5.3 with a good fix made by IRCMaxwell. Here: https://github.com/ircmaxell/password_compat
MD5 has been severely compromised and there are various rainbow tables and collision functions that can find out what an MD5 hash string originally was (down to a handful of options, which are peanuts to compute). Do Not use MD5 for hashing private data.
"How to store the hash"
By Storing the hash I think you mean that you want to store the:
$hash = md5($password_plaintext');
if this is so, then you can store this in a MySQL VARCHAR field, on the record, typically people submit login info with a username password so the username is used for the MySQL engine to find the row, and then the password hashes are compared to see if they match.
Using password_hash(), you would look up the username, then retrieve the associated password hash field value (just that value), and then compare the hash with the plaintext password from the form with:
if(password_verify($posted_login_password_plaintext, $hashfromDatabase)){
//if TRUEPassword matches.
}
That's all you need. You do not need and actually should not store any salts for hashing with.
I have a PHP file which allows users to insert text into the MySql database. I want that data to be encrypted. (Any encryption would be ok for me... MD5, SHA1, SHA512, any of them) And when the user requests the data from the database, it is shown as regular plain text (The value entered by him). Please help me how can I do it?
MD5, SHA1 and SHA512 are hash-functions, no reversible encryption.
I would recommend to use the encryption/decryption pair AES_ENCRYPT and AES_DECRYPT.
MD5, SHA1, SHA512 are hashing and compression tools, so it is impossible to decrypt text that is cloaked by these algorithms (check the difference between hashing and encryption).
These 2 PHP functions could suit your needs for this specific case: you case use this function to encrypt and this one to decrypt
On user registration, concatenate login name and password chosen by him/her with a salt value, hash the concatenation with PHP $PwdHash=md5($salt.$loginname.$password); and store $PwdHash in database.
When the user wants to autenticate later, he/she sends the $loginname and $password again.
Repeat the same with obtained credentials $PwdHash=md5($salt.$loginname.$password); and compare computed $PwdHash with PwdHash stored in your database row corresponding to $loginname.
Salt is an arbitrary constant secret value chosen by you, e.g. $salt="user3668837"; . Using the salt prevents the attacker to dig out passwords from your database with rainbow tables if he managed to steal database content.
I am having trouble to transfer email user account which is saved in MySQL to another server. Here is the detail:
I have an old email server which using MySQL to store user account information. The password field uses MySQL ENCRYPT function to save the users password. So if I want change the user's password I can do:
UPDATE `mail`.`users` SET `password` = ENCRYPT( '12345' ) WHERE CONVERT( `users`.`email` USING utf8 ) = 'g#veecall.com' LIMIT 1 ;
Then the new password "12345" saved in the table as string of " 2I6JOeg.JukJ."
Now I build a new server using iRedMail. When I try to transfer user account I have trouble to transfer the password field. Because the iRadMail/dovecot is using MD5-CRAM to encrypt the password then save it in the MySQL. All the password string is started with "$1$".
So, is there a way to make the MySQL encrypted password string "2I6JOeg.JukJ." convert to MD5 hash "$1$................."?
Thanks for help.
Firstly MD5 is a hashing algorithm not a encryption algorithm. The main reason for this is that it is virtually impossible to calculate the original password from the hash value generated by MD5. MD5 creates a hash value and it basically a trap door function in other words it is a one way function.
Encryption will allow you to encrypt and decrypt IF you knew the key. Big difference. Hope you understand that.
Now for your problem.
Unless you have the original password before it was encrypted there is no reasonable way besides brute force to create the MD5 equivalent of the password. The encrypted passwords hash and the unecrypted/plain text password hash will be two different think.
If you can decrypt all the passwords you currently have to their plain text form you can perform the MD5 hashing on the plain text values. If you cannot get the original plain text then you are out of luck.