Java Storing Encryption string into MySQL Database

Question

I am developing a web application using MySQL and Java Persistence API on Netbeans. The application requires a user to create an account to use and I am trying to encrypt the password before storing into database. The issue is that in my SQL script, I set the user account table that stores the password a string with a size limit of 256 and auto-generated the JPA entity classes. If I stored the password normally, this doesn't create an issue, but the problem becomes whenever I tried to encrypt the password. This is what I originally had:

import org.netbeans.lib.uihandler.PasswdEncryption;

public void encryptPassword(String password)
{
    String encryptedPassword = PasswdEncryption.encrypt(password);

    storeIntoDatabase(password);
}

However, whenever I tried to create a new account, I receive a EJBExcepton which was caused by a javax.ConstraintViolationException.

What I found was that the PasswdEncryption.encrypt was creating a string size greater than 256 which I believe was causing the exception. I first tried modifying my original SQL script to increase the password entry size and ran it, but I still get the same issue because the entity class constraint is still 256. So my question is

Is there a way to change the constraints without having to auto-generate again?
Or create an encryption string with a size of 256 or less?

"I am trying to encrypt the password". Stop right there. Passwords should be hashed, not encrypted, otherwise you lose the legal property of non-repudiation, which to put it simply can send your company broke. Don't do this. See also this question. — user207421
– user207421, Commented Oct 30, 2014 at 0:31

ursa · Accepted Answer · 2014-10-29 22:48:43Z

1

Think twice before storing passwords into database. Even encrypted. It makes your system critically vulnerable. Most users use the same password in several systems. After your system will be hacked - all these passwords become compromised.

Usual practice is to store hashes of passwords, e.g. sha1 or md5. And this also will help you with your problem. I recommend you to revise your authentication approach.

answered Oct 29, 2014 at 22:48

ursa

4,7011 gold badge29 silver badges39 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

nolexa · Accepted Answer · 2014-10-29 22:38:02Z

0

You don't need to generate your entity classes anew. Just change the constraints in you Java code, compile and run your application. Generating entity classes from DDL is just a conveniency offered by NetBeans. You can write your classes and SQL script by hand, or you can generate DDL from Java code, any way you like.

answered Oct 29, 2014 at 22:38

nolexa

2,5122 gold badges20 silver badges19 bronze badges

3 Comments

schen Over a year ago

How would you change the constraints? Where is that located?

nolexa Over a year ago

Constraints are annotations in you generated entity Java class. See the tutorial. It can look like this in your code: @Size(min=2, max=255) private String password

chiastic-security Over a year ago

@schen it might have worked, but your system is badly vulnerable if you're storing encrypted passwords, and there should be no need to do so. See ursa's answer for why, and my answer for what you really ought to be doing instead.

Community · Accepted Answer · 2017-05-23 12:27:22Z

0

You should look into using bcrypt for this. It's the standard for password encryption, and it'll produce strings of much less than 256 characters.

Try the jBCrypt library.

Note that password encryption is a term I'm using loosely here: really bcrypt does password hashing. But that is quite certainly what you ought to be doing, rather than a reversible encryption operation.

See this question for important further details.

edited May 23, 2017 at 12:27

CommunityBot

11 silver badge

answered Oct 29, 2014 at 22:25

chiastic-security

20.5k4 gold badges43 silver badges70 bronze badges

2 Comments

user207421 Over a year ago

It is one implementation of one standard for password hashing. Not encryption, despite its name.

chiastic-security Over a year ago

@EJP sure. I was taking it that's what OP probably really meant, and certainly what OP really wanted. Perhaps I should have been clearer on that.

Collectives™ on Stack Overflow

Java Storing Encryption string into MySQL Database

3 Answers 3

Comments

3 Comments

2 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

3 Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related