One-way encryption transforms input data into a fixed-size, seemingly random string. Also called hashing, it is designed to be practically impossible to reverse, especially for longer values. section 7.4
It is especially useful for passwords. A database stores the hash rather than the plain-text password, limiting the damage if an unauthorized person obtains the database. section 7.4
A practical password-storage change involves these steps:
- Choose a one-way algorithm such as bcrypt, PBKDF2, or Sha512. section 7.4
- Hash passwords before storing them instead of keeping their original values. section 7.4
- Size the password column for the encoded result; the bcrypt example changes it to CHAR(60). section 7.4
Revising a password column
For the user table, replace a plain-text password column with storage for the bcrypt result: ALTER TABLE user MODIFY COLUMN password CHAR(60); Binary results may be encoded as ASCII, such as with Base64, for easier storage and handling. section 7.4
