Re: How to validate passwords without storing them anywhere.

This seems to be a variation on password hashing.

https://dev.to/kmistele/how-to-securely-hash-and-store-passwords-in-your-next-application-4e2f

I would be interested to know what security experts have to say on which method is better.

They seem very similar because the stored password hash isn't really the password either.

Regards,
Richard Schoen
Web: http://www.richardschoen.net
Email: richard@xxxxxxxxxxxxxxxxx
------------------------------

message: 2
date: Wed, 17 Mar 2021 13:35:11 -0400
from: "Larry \"DrFranken\" Bolhuis" <midrange@xxxxxxxxxxxx>
subject: Re: How to validate passwords without storing them anywhere.

Nice. I rather like it!
- L

On 3/17/2021 1:29 PM, Rob Berendt wrote:

-- How to verify passwords without ever storing passwords.
-- Thanks to Darren Strong of Dekko.

-- The basic concept is that you do not store the password.
-- Instead you store a common string encrypted by the password.

-- As a war on 5250 tools the "short names" are obscured.

set current schema = 'ROB';
CREATE OR REPLACE TABLE Security_table for system name T000000001 (
Security_id for column C000000001 varchar(100) ALLOCATE(10) not null constraint Security_table_primary_key PRIMARY KEY,
Security_name for column C000000002 varchar(100) ALLOCATE(25) not null,
Password_Encryption for column C000000003 varchar(256) FOR BIT DATA
)
RCDFMT T00000001R
;
-- Let's say the password is Budweiser#01.
-- So you encrypt the word VALID with that as an encryption key and all you are really storing is VALID.
insert into Security_table (
Security_id, Security_name, Password_Encryption)
Values('ROB', 'Rob Berendt', ENCRYPT_TDES(varchar('VALID'),
'Budweiser#01'));
-- Now when they enter their password you pass that as a decryption key to see if it is valid.
Select DECRYPT_CHAR(Password_Encryption, 'Budweiser#01') from
Security_table where Security_id = 'ROB';
-- Test to see if the user 'ROB' was found'
-- Test to see if the encryption key was valid by checking the value returned.
-- If the value returned was not the word VALID the person entered an invalid password.
-- Or don't let the user know they guessed the userid and return generic error if either is invalid.