Question

I don’t know too much about encryption, but is there any benefit to encrypting the already encrypted, lets say passwords? I am aware of salts, but before this is done, does it matter or not?

Answer 1

Encryption is 2-way thing, when hashing is 1-way. You can decrypt encrypted sting, while you can’t revert hash.

One simple, but good example is using md5 hash + salt: MD5(‘password’ + ‘random_string’) – no matter PHP or MySQL you use – result is the same. So what you have here – is hash of ‘passwordrandom_string’, which can be unlikely matched using a dictionaries.

So every time you check the password you do:

if (md5($password . 'random_string') == $hash_from_db)

Updated: but if you really concerned about security (this usually needs to be done only if your application works with very sensitive data), and say more – you have crazy paranoia and insanity about it: there are a lot of hashing methods over the Internet. Find something with random salt (so every password can have almost unlimited amount of hashes), make few changes, combine it with other hashing algorithm – problem solved.

One thing you should know – sometimes the slower hashing works – the better. That means if you somehow have a rat-hole in login-attempts counter this will really slow down bruteforce process.

One example you can take a look on – bcrypt (it uses Java for hashing). Not saying you should use it, just an example of what you should look for.