spring mvc - How do I store a salt in mysql database for secure password encryption? -

i'm using shiro spring mvc login users. configure shiro in applicationcontext.xml (no ini file).

this realm configuration:

  <bean id="myrealm" class="org.apache.shiro.realm.jdbc.jdbcrealm">     <property name="datasource" ref="datasource"/>     <property name="authenticationquery" value="select password usuarios email = ?"/>     <property name="credentialsmatcher">         <bean class="org.apache.shiro.authc.credential.hashedcredentialsmatcher">               <property name="storedcredentialshexencoded" value="false"/>               <property name="hashiterations" value="1024" />         </bean>     </property>   </bean> 

this code generating salt , hash when user registers:

randomnumbergenerator rng = new securerandomnumbergenerator(); object salt = rng.nextbytes();  string hashedpasswordbase64 = new sha256hash(password, salt, 1024).tobase64();  u.setpassword(hashedpasswordbase64); u.setsalt(salt.tostring());  usuariodao.saveusuario(u); 

here saveusuario(u) calls dao persist user in mysql. guess salt.tostring() wrong.

the user table is:

create table usuarios (   id integer auto_increment,   nombre varchar(50), ...   password varchar(50),   salt varchar(50), ...   primary key (id) ); 

questions are: - type should hash field in db? hash created rng.nextbytes , of type object. - how declare field or query hashedcredentialsmatcher can authenticate properly?

first, please read thomas pornin's canonical answer how securely hash passwords.

then, note java 8 have pbkdf2-hmac-sha-512 available now pbkdf2withhmacsha512 - use instead. sha-512 in particular has 64-bit operations reduce advantage gpu based attackers have. use more iterations 1024, - see system can handle comfortably under load!

use those, or bcrypt, or scrypt. use @ least 12 byte cryptographically random salt.

do not request more 64 (binary) bytes out of pbkdf2-hmac-sha-512, more 32 (binary) bytes out of pbkdf2-hmac-sha-256, or more 20 (binary) bytes out of pbkdf2-hmac-sha-1, or actively give attackers advantage.

you can absolutely store both hash , salt in database in binary() fields, or convert them base64 or hexadecimal; that's you. binary() smallest, , requires no conversions going in or coming out.