lundi 23 février 2015

Java SecureRandom as salt



Is this the correct way of generating salts for passwords?



SecureRandom random = new SecureRandom();
byte[] salt = random.generateSeed(64);

String decoded = new String(salt, "Cp1252");
System.out.println(decoded);


I am trying to generate new passwords (SHA-512), so I will also need a salt.

The hashed password will be = user password + salt ... is this correct?

Wouldnt these strange characters "break" the DB (MySQL)?


Few outputs:



ã2}wÑ»-ÄKÇæꮃzR4qÉÖÙÚ!ž0ÉW9;*Vß4x»)
àöˆ˜£¿{,J¼…HþTù#+Bv(Fp´G~Aò`^e_ElpíÜžS A!­ñÛz‹y@`ý‡)‡ª€
5a£Æ.¥sgöfÈB:4-�y$Óx%Óâyý¾N¨…áq


Should these salts be also encripted as SHA-512?




Aucun commentaire:

Enregistrer un commentaire