0

I had a project where I was storing salted hashed passwords like this:

byte[] salt = getSalt();
sql = "INSERT INTO user_login (user_mail, user_handle, user_password, user_salt) VALUES (?,?, SHA2(CONCAT(?, ?), 256), ?)";

prepStmt = conn.prepareStatement(sql);

prepStmt.setString(1, user.getUserMail());
prepStmt.setString(2, user.getUserHandle());
//Process password
prepStmt.setString(3, user.getUserPassword());
prepStmt.setBytes(4, salt);
prepStmt.setBytes(5, salt);

prepStmt.executeUpdate();

The login process being:

sql = "SELECT * FROM user_login WHERE user_mail=? && user_password= SHA2(CONCAT(?, ?), 256)";

prepStmt = conn.prepareStatement(sql);

prepStmt.setString(1, user.getUserMail());
prepStmt.setString(2, user.getUserPassword());
prepStmt.setBytes(3, salt); // being retrieved beforehand
res = prepStmt.executeQuery();

And the update being:

sql = "UPDATE user_login SET user_password = SHA2(CONCAT(?, ?), 256), user_salt = ? WHERE user_id=?";

prepStmt = conn.prepareStatement(sql);

// Process password
prepStmt.setString(1, newPassword);
prepStmt.setBytes(2, newSalt); // being generated beforehand
prepStmt.setBytes(3, newSalt);  

prepStmt.setInt(4, currentUser.getUserId());

The important part being this where the database does the work of salting and hashing.

SHA2(CONCAT(?, ?), 256)

Questions:

  • How would I translate this part into JPA/Hibernate?
  • Is it possible using "@Query", "@Formula" or something else for example?
  • Is it even possible to translate to begin with? And if not, is there a way to implement such a thing without conflicts from JPA/Hibernate?
  • Should I use database triggers/procedures?*

Thank you for your time.

*edit

CD Navras
  • 1
  • 1

0 Answers0