I believe openssl crypto module (http://www.openssl.org/docs/crypto/crypto.html) implements all you need. It is written in C, not CPP, but I believe you can easily warp it in a class, if you need some OOP feature.

Also, are you set in stone for this method?

The method I am using is (register):

1) Generate a random number.

2) Decrypt the password received by the client

3) Calculate a hash using the password and the random number

4) Save on the DB the random number (step 1) and the hash (step 3).

To authenticate:

1) Decrypt the password received by the client

2) Calculate the hash using the random number saved on database.

3) Check if saved hash match with the one I just calculated.

[quote name='KnolanCross' timestamp='1357251120' post='5017271']
1) Generate a random number.
2) Decrypt the password received by the client
3) Calculate a hash using the password and the random number
4) Save on the DB the random number (step 1) and the hash (step 3).

To authenticate:
1) Decrypt the password received by the client
2) Calculate the hash using the random number saved on database.
3) Check if saved hash match with the one I just calculated.
[/quote]

Uh, I hope you are using SSL/TLS or something similar to transmit password information securely, otherwise this is vulnerable to a replay attack.

1) Generate a random number.
2) Decrypt the password received by the client
3) Calculate a hash using the password and the random number
4) Save on the DB the random number (step 1) and the hash (step 3).

To authenticate:
1) Decrypt the password received by the client
2) Calculate the hash using the random number saved on database.
3) Check if saved hash match with the one I just calculated.

Uh, I hope you are using SSL/TLS or something similar to transmit password information securely, otherwise this is vulnerable to a replay attack.

Since he said he is using a safe conection, I didn't clarify this part. But yes, I am, RSA (2048 bits key) with PKCS#1 v1.5 to be more exactly.

On hashes, depends on the algorithm you are using. For instance, MD5 has been broken, but SHA2 and SHA3 haven't (link: http://en.wikipedia.org/wiki/Sha512)

EDIT:

In case anyone in the future is interessed using the python lib, here is the link to its documentation:

http://packages.python.org/pycrypto/

And the package, current versions as of the date of this post:

http://pypi.python.org/pypi/pycrypto/2.6

Even at that speed he would still take 2 years to calculate all the possible hashs. The main point of any cryptography search space is that it grows exponentially, while the attacker's power grows linearly.

Still, assuming he can "break" the hash by bruteforce in some fast way, he will only find the random number operated with the password, not the password itself (which is useless).

Even at that speed he would still take 2 years to calculate all the possible hashs. The main point of any cryptography search space is that it grows exponentially, while the attacker's power grows linearly.

Still, assuming he can "break" the hash by bruteforce in some fast way, he will only find the random number operated with the password, not the password itself (which is useless).

If the attacker doesn't have access to your database, then it's fine. But if he does, then he has access to this random number, and can mount a standard brute-force attack on the password space, which is considerably smaller than the hash's entire search space, this is why you want a slow hashing function in case your database is compromised (and yes, saying "this will never happen" is an easy way to be sorry later on).