So I just got an entry level job at a company, and I have been given a business application to tweak and improve. I have a senior, and more experienced programmer overseeing me, but I have found what I consider to be a bad practice in the company application. I have been reading a C# data security book, and have been introduced to hash algorithims (crypto). I know that for authentication hash algorithims are useful due to the fact that the company need not store passwod information in the clear as well as the fact that with a hash algorithim you cannot actually reverse the password to it's plain text. What you do when the user submits the password, is instead of decrypting the cypher text, you hash what the user gives you, and therefore get identical cypher texts. What I have found is that my company is using a very secure Symmetric Algorithim. The problem I have with this is we shouldn't be able to decrypt the user's password at all. The code appears to be a drop in and replace thing, but I have little experience in upgrading the database where the cyphertext is stored, so I was wondering, how would one go about swapping out the algorithims in the DB. Would you temporarily allow for the fact that both algorithims could be used in the code, or do you create a program that makes the necessary conversions, and uploads the data to another server, or what? I am not going to post code here, like I said, the actual replacement in the code would be pretty much a drop in replacement. Also, what Hash algorithims are generally considered secure for this kind of thing.
I know that the higher the number after the algorithim, generally the better secured it is, because it "rotates" or morphs the data that many times, but would need to do some research. What algorithim is usually best for this kind of thing though.
I have also used Visual Studio to track down all usages of the decryption method, and it does appear to be only used for authentication.
