For securing the passwords I use Sha-512 over the salted password.
User>>initialize
super initialize.
salt := (Nacl randomBytes: 16)
User>>setPassword: aPassword
hashedPassword := Nacl hash: (salt , aPassword asByteArray)
User>>validatePassword: aPassword
^ hashedPassword asByteArray = (Nacl hash: salt asByteArray , aPassword asByteArray)
������������������������������������
Notice that:
1) I have a different salt for each password, if a bad guy want the passwords he is going to need a different rainbow table for each user.
2) I do not store the password. I do not even store the hash of the plain password.
3) Still I���m able to validate the password.
* Note that I���m using Nacl>>randomBytes: to generate a cryptographically safe random value. Here is not really necessary, BUT you should use it if you are creating Session-IDs or Tokens.
Encrypting the database is *tricky*. You not only have to encrypt the database, but also secure the key. First you need to know how much security you want:
1) Be secure if someone hack into the user running pharo.
3) Be secure if someone steal the server.
4) Be secure if someone has physical access to the running server. (All your keys are in RAM)
2) Be secure if someone hack root. (I doubt anything is going to save you here)
For most projects/business (unless working with really sensitive data, such as medical data) securing the OS (users and root) and encrypting the hard-disk should be enough. Also do not forget to encrypt the connections. If everything is on the same server just use https. But you may need more if you use Load Balancers, multiple servers and databases.
Cheers,
Alejandro
As for single username/pass encryption (not the whole DB), and assuming you want two-way encrypt (that you want to decrypt), I have used both, Rijndael and Blowfish, both in combination with SpsSplitPasswordStore.
Cheers,