在安全代码中需要不同的字符

Question

Example security code:

a35sfj9ksdf

How can I ask a user for several characters (e.g. first, forth and ninth) of their security code and then check these? The main difficulty comes in how do I store the seucurity code in an encrypted form - if I were to store each character individually, then the encryption would be incredibly easy to break.

Answer 1

A possibility that was described neither here nor at How to store and verify digits chosen at random from a PIN/Password is this:

• Create a random salt of the same length as the seucrity code (here 11)
• Store the salt with the user
• for every char of the security code, replace the corresponding char of the salt with the char from the security code and hash it securely
• store these hashes with the user

Now you have to store the manageable quantity of n+1 fields for a security code of length n and can still verify single (position,char) tuples