Server authorization with MD5 and SQL.

Question

I currently have a SQL database of passwords stored in MD5. The server needs to generate a unique key, then sends to the client. In the client, it will use the key as a salt then hash together with the password and send back to the server.

The only problem is that the the SQL DB has the passwords in MD5 already. Therefore for this to work, I would have to MD5 the password client side, then MD5 it again with the salt. Am I doing this wrong, because it doesn't seem like a proper solution. Any information is appreciated.

Answer 1

You should use SSL to encrypt the connection, then send the password over plain text from the client. The server will then md5 and compare with the md5 hash in the database to see if they are the same. If so auth = success.

MD5'ing the password on the client buys you nothing because a hacker with the md5 password can get in just as easy as if it was in plain text.

Answer 2

It is not completely clear to me what are you asking, but python hashlib (read the FAQ) and wikipedia should get you to where ever you are going.

For real world example in python check django authentication (the source).