I'm creating a program (in C++) that will password protects its user's database (.dat) file. I'm confused on where to store the password? In the user's database file or somewhere else.
I'm new to this concept. I don't know where a program should store the hashed password. I've been thinking for this from a long time.
I have a question too. If a program stores hashed password in the database file (along with users data) is it possible for an attacker to modify the hash inside the file to some common hash like the hash of the text 'password' so that the password becomes 'password'?
Edit: Okay! I've somewhat understood the password storing concept. This is what I've understood:
Get the password from the user
Hash it (I will use SHA-512)
Store the hash in the database file
Probably, I didn't understand the symmetric hash concept. Please explain me in an easy way. And the question I have is... I'll better explain it with an example.
Assume this is user's file's content
User decides to add a password. He types in the password and we hash it. The generated hash is somerandomhash. We encrypt the file with somerandomhash as the password and the hash is included in the encrypted file. So now the file content is
Imagine the attacker got the encrypted database file. He knows that the hash of the password is "somerandomhash". He now modifies the password hash 'somerandomhash' to something common like 'somehashthatheknows'. So what is a better way to store a password.
For ease, how do programs like zip, 7z, rar etc store passwords inside a archive file?