Should I convert my string sha1, in java or php?

Question

I am developing an android application which has login and register. And I store my database in phpMyAdmin. I want to store passwords in sha1. And my application communicate with the database through php.
My question is that in phpmyadmin what type should be the password column? Varchar or BINARY(20)? I should convert the password in java or php? Which is easier? Is there any built-in method for that in java or php? Should I use any other encryption?
Should I use this?

private static String encryptPassword(String password)
{
    String sha1 = "";
    try
    {
        MessageDigest crypt = MessageDigest.getInstance("SHA-1");
        crypt.reset();
        crypt.update(password.getBytes("UTF-8"));
        sha1 = byteToHex(crypt.digest());
    }
    catch(NoSuchAlgorithmException e)
    {
        e.printStackTrace();
    }
    catch(UnsupportedEncodingException e)
    {
        e.printStackTrace();
    }
    return sha1;
}

private static String byteToHex(final byte[] hash)
{
    Formatter formatter = new Formatter();
    for (byte b : hash)
    {
        formatter.format("%02x", b);
    }
    String result = formatter.toString();
    formatter.close();
    return result;
}

The formatter which type? Java.util or java.util.logging, android.text.format ?

"Where": as early as possible. "Other than sha1": sha1 is outdated, use sha-2 or sha-3. — Tom, Mar 23 '16 at 17:41
Whatever you do, the client should never actually see the stored hash (to prevent brute-forcing). It is also advisable to include a (per-user) static nonce before hashing (to combat rainbow tables, should any hashes ever leak out). — Siguza, Mar 23 '16 at 17:44

score 0 · Answer 1 · edited May 23 '17 at 10:28

First you might wanna check out: best-way-to-store-password-in-database

As mentioned in some comments you should know SHA-1 is outdated. Also be aware of the fact that SHA-1 is irreversible. So once you hash the users password, "there's no way" to get the original password back.

About when or where you should encrypt or hash the password. I'd do it in my Android app. This way the password is already encrypted when you send it over the wire.

Should I convert my string sha1, in java or php?

1 Answers1