Understanding salted password hashing using Java

Question

Context:

I am using this tutorial and trying to understand and implement salted password hashing using Java. After spending some time on this topic, I figured out that the basic idea is to:

1. Convert the password string to a character array.
2. Generate a random salt using SecureRandom(or similar).
3. Hash the password character array with a standard cryptographic hash function.
4. Convert the salt and hash byte arrays to respective hexadecimal strings.
5. Prepend the hexedSalt to hexedHash and save the resulting string along with the hexedSalt to the database.

Questions:

• What's the point of prepending the constant PBKDF2_ITERATIONS to createHash(char[] password) method?
• Is my understanding of the whole process correct?
• Here is the link to my source code - which value should I save as hash and which value as salt?

Answer 1

PBKDF2 is a password hashing function(*); it uses a configurable number of iterations (to make it as slow as is appropriate) and a salt (to deter all kinds of parallelism in attacks). To verify a password, the hash is recomputed, and should yield the same value. To perform this recomputation, you need to use the same number of iterations and the same salt value; otherwise you will get a distinct output and will be none the wiser.

A new salt shall be generated for each new registered password (e.g. whenever a new user account is created, and also whenever a user changes his password), so it must be stored along with the hash value.

The iteration count should also be stored, because it may be modified at some point. In the code you link to, the count is a constant (static final), but its conceptual role is to counter the increase in performance of computers over time: you use the number of iterations to make each password hashing as slow as you can tolerate, because it will also make it slow for the attacker. When you buy a new, faster server, you may want to increase the iteration count (i.e. modifying the source code and recompiling the application, with a higher count). However, in that case, you do not want to invalidate existing, stored hashed passwords. Thus, you need to know, for each stored hash, how many iterations were used for that specific hash. This is why the iteration count is stored along with the salt and the hash value itself.

^{(*) Strictly speaking, a password-based key derivation function, but let's keep things simple.}

Answer 2

Basic password hashing with salts only involves the password and a random salt that are joined together before creating the hash. You don't mention that joining process in your explanation and it's important because otherwise the salt doesn't add any security.

The example you've linked to is using a more advanced type of password hashing using PBKDF2 which also has an iteration count (number of times to repeat hashing process). That's reflected in their code with

byte[] hash = pbkdf2(password, salt, PBKDF2_ITERATIONS, HASH_BYTE_SIZE);

So they have to store that iteration count, salt, and final password hash to use when recomputing a hash for password comparison purposes. If you're going to implement this example then you will need to store this same data.