Question

I have a database with users and I want to have a random salt for each user that is saved in the column Salt and a hash of their salt+password in the field password.

I can insert them like this:

INSERT INTO users([Username], [Password], [Salt])
VALUES('David', HASHBYTES('SHA1', 'randomgeneratedsalt' + 'theirpw'), 'randomgeneratedsalt')

But how do I select them?

My own try is:

select * 
from users 
where Username = 'David' 
  AND Password = HASHBYTES('SHA1', Salt + 'enteredpw')

Of course I can select the salt for the user that is trying to login, but I’d like to do it without doing so.

Answer 1

You select them by username, which must be unique. After you locate the user you can compare the presented password hash against the stored one. Only need be careful to display the same error whether username was not found or hash don’t match (ie. prevent information disclosure that the username is valid).