What is the best mechanism for storing passwords into database after encryption of the password? And what is the method of encryption and an implementation in Java?
Never store encrypted passwords. Store a secure one-way hash instead, something like SHA-1 (has some minor security issues), or one of the newer, more secure variants.
Doing so is actually against several regulatory requirements that you may be subject to, such as the PCI DSS if you have any involvement with credit cards (doing any e-commerce?).
+1 for Borealid's comment - even with hashing, the hashing needs to be done properly, and must include "salt" (additional random data to prevent a subset of attacks). jBCrypt will do this for you (as will other similar libraries).
A common way to store passwords is to hash them using a message digest algorithm. I'd recommend SHA1, or if you need more bytes (-> less collision possible), SHA256 or 512. Here's an SHA1 implementation in Java:
发布评论
评论（2）
从不存储加密密码。而是存储一个安全的单向哈希值，例如 SHA-1 （具有一些次要的安全性）问题），或更新、更安全的变体之一。
这样做实际上违反了您可能需要遵守的多项监管要求，例如如果您涉及信用卡（从事任何电子商务？），则需要遵守 PCI DSS。
像 http://www.mindrot.org/projects/jBCrypt/ 之类的东西也可能有用。
+1 Borealid 的评论 - 即使使用散列，散列也需要正确完成，并且必须包含“salt ”（用于防止攻击子集的附加随机数据）。 jBCrypt 将为您执行此操作（其他类似的库也是如此）。
Never store encrypted passwords. Store a secure one-way hash instead, something like SHA-1 (has some minor security issues), or one of the newer, more secure variants.
Doing so is actually against several regulatory requirements that you may be subject to, such as the PCI DSS if you have any involvement with credit cards (doing any e-commerce?).
Something like http://www.mindrot.org/projects/jBCrypt/ may also prove useful.
+1 for Borealid's comment - even with hashing, the hashing needs to be done properly, and must include "salt" (additional random data to prevent a subset of attacks). jBCrypt will do this for you (as will other similar libraries).
存储密码的常见方法是使用消息摘要算法对密码进行哈希处理。我建议使用 SHA1，或者如果您需要更多字节（-> 可能发生的冲突更少），请使用 SHA256 或 512。这是 Java 中的 SHA1 实现：
http://www.anyexample.com/programming/java/java_simple_class_to_compute_sha_1_hash.xml
还建议您使用盐来使猜测密码哈希变得更加困难。说明：
http://en.wikipedia.org/wiki/Salt_(cryptography)
A common way to store passwords is to hash them using a message digest algorithm. I'd recommend SHA1, or if you need more bytes (-> less collision possible), SHA256 or 512. Here's an SHA1 implementation in Java:
http://www.anyexample.com/programming/java/java_simple_class_to_compute_sha_1_hash.xml
It's also advised that you use a salt for making gessing password hashes even harder. Explanation:
http://en.wikipedia.org/wiki/Salt_(cryptography)