A07:2021 Identification and Authentication Failure clarification needed

[ninedter]

while translating A07:2021, we felt it was a bit weird on the following description:

Uses plain text, encrypted, or weakly hashed passwords (see A3:2017-Sensitive Data Exposure).

I can understand plain text, weakly hashed password being part of protecting against failure of identification & authentication password, but encrypted password being part of it, it felt a bit weird. If encrypted password is used as is to gain access, that is understandable, but I though we might need better explanation or elaborate it a bit to make it more clear?

[sslHello]

Hi @ninedter,
thank you for your issue.
Agreed, it is not about how to handle passwords for technical users used by the server or application itself.
Id' like to discuss two possible small changes to clarify this:

• Uses plain text, encrypted, or weakly hashed user passwords
• Uses plain text, encrypted, or weakly hashed password databases
  Cheers Torsten

[vanderaj]

data stores for the win

[szh]

I think the point being made is that applications are supposed to hash passwords rather than encrypt them, since hashing is one-way whereas encryption can be undone. There are some more details in the A02 page:

Store passwords using strong adaptive and salted hashing functions...

CWE-328 Reversible One-Way Hash

So encrypting passwords, no matter what kind of encryption is used, is inherently weaker than hashing.