Verifying a hashed password in another Python class

Question

1.00/5 (1 vote)

See more:

I am trying to verify user login but it's not working as expected. The password stored in the database is encoded and hashed. There is a login class which has a function named sqllog, this is where the code for logging in is. There is another class named registerTB, this class has a function named hash_password. Now to enable my login verification, I need to use one of the variables of the hash_password function, this variable is named SALT. I am having problem using it. I called the registerTB class and its function "hash_password" in the sqllog function of the Login class but when I run the code and try to log in, it runs the hash_password function and then reject the inputted password as incorrect even though it is correct.

Here is my code:

Python

def SQLLog(self):                #this calls the hashpassword method of class registerTB because I need to use the SALT variable there.
registerTB().hash_password()
msgBox = QMessageBox()
msgBox.setIcon(QMessageBox.Information)
msgBox.setGeometry(100, 100, 100, 100)
try:
    username = self.user.text()
    passwordd = self.pw.text()
    hashpass = hashlib.pbkdf2_hmac("sha256", passwordd.encode(), salt, 10000)
    strhash = str(hashpass)
    print(strhash)

    conn = pyodbc.connect('Driver={SQL Server}; Server=mine1;database=logistics; Trusted_Connection=yes;')
    result = conn.execute("SELECT * FROM employees WHERE userID = ? AND pw = ?", (username, strhash))
    print("connected to database")
    if (len(result.fetchall()) > 0):
        print("user found")
        msgBox.setText("LOGIN SUCCESSFUL")
        msgBox.setWindowTitle("MESSAGE FROM DB")
        msgBox.exec_()
        self.toggle_logistics()

    else:
        print("user not found")

Here is the code for the hashpassword function:

def hash_password(self):
try:
global salt
password = self.pwTx.text()
pwcon = self.pwCtx.text()
salt = os.urandom(16)
password_hash = hashlib.pbkdf2_hmac("sha256", password.encode(), salt, 10000)
pwcon_hash = hashlib.pbkdf2_hmac("sha256", pwcon.encode(), salt, 10000)

self.strpw = str(password_hash)
self.strpcc = str(pwcon_hash)

I want users to be able to login and their correct passwords match with what are stored in the database table.

What I have tried:

I tried calling the class with the SALT attributes but it seems I was not doing it right.
I made the SALT attribute global also so it can be called and used anywhere but it's now working. It's insisting I must define it in the new class

Posted 8-Sep-21 3:54am

CEO CEO

Updated 8-Sep-21 5:20am

Richard Deeming

v2

Add a Solution

Comments

CEO CEO 8-Sep-21 15:41pm

Hello Mr. Richard, I noticed something again. Am I to also create a column for the plain password in my database?

I saw in your sql statement where you wrote SELECT FROM pw, SALT,

Please is that pw for the plain password or the hashed password generated earlier?

1 solution

Add a Solution

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Richard Deeming · Accepted Answer · 2021-09-08T04:03:00

You can't do it like that!

You need to have a separate random salt for each password. Which means that you need to store the salt alongside the password.

As a result, you cannot filter on the pw column in your database. Instead, you need to load the salt and the hashed password for the supplied username, calculate the hash using the entered password and the stored salt, and then compare it to the hashed password from the database.

Secure Password Authentication Explained Simply[^]
Salted Password Hashing - Doing it Right[^]

Quote:
No, you're not to produce a separate salt for the password, confirmation and login verification. That would make the passwords different.

That's the whole point! You have a different salt value for each stored password. When you verify the entered password, you combine it with the salt value stored against that user's record to produce the hash, and then compare that hash to the stored hash.

The whole point of a salt is to make it much harder to find the original password, since an attacker can no longer rely on a "rainbow table" of precomputed hashes. It also makes it impossible for the attacker to see which accounts have the same password, since the random salt ensures that the stored hash will be different even if the plain-text password is the same.

EDIT 2:
I don't "do" Python, but the basic approach is as follows:

Python

username = self.user.text()
password = self.pw.text()

conn = pyodbc.connect('Driver={SQL Server}; Server=mine1;database=logistics; Trusted_Connection=yes;')
print("connected to database")

result = conn.execute("SELECT pw, salt FROM employees WHERE userID = ?", username)
row = result.fetchone()
if row:
    print("user found")
    
    storedhash = row[0]
    salt = row[1]
    
    hashpass = str(hashlib.pbkdf2_hmac("sha256", password.encode(), salt, 10000))
    
    if hashpass == storedhash:
        msgBox.setText("LOGIN SUCCESSFUL")
        msgBox.setWindowTitle("MESSAGE FROM DB")
        msgBox.exec_()
        self.toggle_logistics()

    else:
        print("Invalid credentials")

else:
    print("Invalid credentials")

Obviously, you'll need a column in your database to store the salt value, and you'll need to update your user registration code to store the generated salt value in that column.

And avoid using global variables.

Verifying a hashed password in another Python class

1 solution

Solution 1

Add your solution here

Preview 0

Verifying a hashed password in another Python class

1 solution

Solution 1

Add your solution here

Preview 0

Existing Members

...or Join us