How to store user password security

First: The basics: Add salt hash (Hashing with salt)

We already know how quickly malicious attackers use query tables and rainbow tables to crack common hash encryption. We have also

It is understood that this problem can be solved by using a random salt hash. But, what kind of salt value do we use, and how will it

Mixed in with the password?

The salt value should use an encrypted secure pseudo-random number generator (cryptographically secure pseudo-random

Number Generator,csprng) is generated. Csprng and ordinary pseudo-random number generators are very different,

The rand () function, such as the "C" language. As the name implies, CSPRNG is designed to be used for cryptographic security, which means it can

A random number that is highly random and completely unpredictable. We don't want the salt value to be predicted, so we have to use CSPRNG.

The following table lists some of the csprng methods for the current mainstream programming platform.

Platform	csprng
Php	Mcrypt_create_iv, Openssl_random_pseudo_bytes
Java	Java.security.SecureRandom
Dot NET (C #, VB)	System.Security.Cryptography.RNGCryptoServiceProvider
Ruby	SecureRandom
Python	Os.urandom
Perl	Math::random::secure
C + + (Windows API)	CryptGenRandom
Any language on Gnu/linux or Unix	Read From/dev/random Or/dev/urandom

Each user's password must use a unique salt value. Each time a user creates an account or changes a password, the password should take a new random salt value.

Never re-use a salt value. This salt value should also be long enough to allow for a sufficient amount of salt to be used for hash encryption. One rule of thumb is that salt

The value must be at least as long as the output of the hash function. The salt should be stored in the user account table along with the password hash.

Steps to store your password:

1. Use CSPRNG to generate a sufficiently long random salt value.

2. Mix salt values with passwords and encrypt them using a standard password hash function, such as Argon2, Bcrypt, Scrypt, or PBKDF2.

3. The salt value is stored in the user database along with the corresponding hash value.

To verify the password:

1. Retrieves the user's salt value and the corresponding hash value from the database.

2. The salt value is mixed with the password entered by the user and is encrypted using a generic hash function.

3. Compares the result of the previous step with the same hash value as the database store. If they are the same, the password is correct; otherwise, the password is incorrect.