store a hashed password in database is the best practice?

I want to know if the best practices to store password in database is
hashed password, and without any encryption involved? I saw some
postings saying to hash a password as the key, and then encrypt it with
the password. I don't quite understand the purpose, since hash a
password itself should be secure enough and hash function cannot be
reversible.

Please advice. thanks!!

.

Relevant Pages

  • Re: store a hashed password in database is the best practice?
    ... hashed password, and without any encryption involved? ... I don't quite understand the purpose, since hash a ... If you're in a high security environment there are many other ...
    (sci.crypt)
  • Re: store a hashed password in database is the best practice?
    ... hashed password, and without any encryption involved? ... I don't quite understand the purpose, since hash a ... If you are attacking a single password, the salt is more or less ...
    (sci.crypt)
  • Re: store a hashed password in database is the best practice?
    ... hashed password, ... postings saying to hash a password as the key, ... I don't quite understand the purpose, since hash a ... Do you want to use it to encrypt things? ...
    (sci.crypt)
  • RE: Signing before Encryption and Signing after Encryption
    ... The property that a hash match is supposed to verify (is this ... Signing before Encryption and Signing after Encryption ... Signing with symmetric keys is a lot more ...
    (Security-Basics)
  • Re: Newbie - Is this Reasonable?
    ... because this hash is stored in the database. ... So you use PKCS5v2 to generate a key hash from a salt and the user's passphrase, then store the salt and the hash in a database. ... are even more critical in database applications because the payoff from tampering with selected fields may be much higher, fields tend to be fixed-length so it's easier to tamper with them in a meaningful way, and databases lend themselves to off-line analysis, so the attacker can marshall more resources and take more time to attack your system. ... You're using a stream cipher for encryption. ...
    (sci.crypt)
Quantcast