Is it beneficial to encrypt usernames stored in the database?

Question

The first & accepted answer on this question about passwords management suggests to encrypt the user identifiers in DB.

The good point is that if anyone gets a password, he has to know how to decrypt the user login to get the full login/password pair.

Some disadvantages I see, for example:

• you have to decrypt user logins every time you want to display them
• if you want to do a 'begins with' search on user login to find users, you cannot simply use LIKE '...%'
• ORDER BY on login field may be quite difficult too...

What would you recommend (encrypt user identifiers or not)?

Answer 1

As usual, the answer is "it depends".

In general, I'd say that if an attacker has access to your database, your security situation is so badly compromised that encrypting the passwords will likely do you no favours. This is different to using a one-way hash - it's likely that an attacker who has access to your database also has access to your decryption key, whereas one-way hashes, by definition, are one way.

As you already say, it's likely that you will need regular access to the userIDs (esp. if you use email addresses as user IDs); in that case, again, an attacker who can read your database likely can intercept the unencrypted data.

So, if you work for a bank, the government, or any other place where data security has to be at the very top of the list, this additional protection may just be worth it, especially if you have a strong key management system.

For other uses, I'd consider the additional security too small to merit the additional pain.

Answer 2

Encryption is considered to be a lesser form of secret storage than message digest functions. In fact, storing an encrypted password is a clear violation of CWE-257.

But why not hash the username? When the login the application will have the plain text. Depending on your application, you might not need to display a list of users. this would be an added layer of security, as both hashes have to be broken before the attacker can login.

That being said, if you have a plain text list of every username it will be trivial to perform a dictionary attack against any recovered hash. Further more user names are not created to be difficult to guess, often times users choose goofy names of birds or silly games like chess so that they are easy to remember.