java - Hashed and Salted Password is not always the same -


i using apache shiro security layer in spring app , encountering weird situation.

firstly, how security system set up. when user registers password hashed securely generated random salt. salt , hashed password stored in db. works 100% when register , login works great too, couple of days go , hashed passwords aren't matching longer. here code:

import org.apache.shiro.codec.base64; import org.apache.shiro.crypto.hash.sha256hash;  public static void main(string[] args) {         string plainpassword = "testing";         string salt = "8aftpriretydsg39+37rqhnryvzluxqyxygwxi55f1pbhbuqsefgclkshpa6thzks3uqennjhksqcv5oancr9lqixmmyc8duqr2aqaqyjlkpnmvlb69jj7emnq0k6ccfbdv/o4jgt2u689leng6cqn+9kqw2gbgt2civolapa34=";          system.out.println(new sha256hash(plainpassword.tochararray(), base64.decode(salt), 1024).tobase64()); } 

the resulting hashed password is:

b8vlt/ekv8f5kwdjrgdkm+pavqc8sk7ooflt91juaxa=  

but password have in database, working , generated exact same salt couple of days ago was:

xznbnlua8vrqq0qy5bbketzztzztgrth2kzkijqdilu= 

so can imagine, stumped. know if doing wrong? or if have left step out.

update 1: after registering new user in system, looks other users in system have passwords changed reason. has nothing way password hash generated , more database access layer.

it seems problem unrelated hashing , salting. sending improper queries update unwanted records.

but i'll throw in advice salting - use different salt every user. otherwise passwords not secure. imagine happens if obtains salt , database. in while (could weeks, it's not much) able generate rainbow table , have of passwords. while if use different salt, have generate many rainbow tables number of users.


Comments