Help with Validating hashed password
Hi! I'm learning how to hash a user password during user registration. It looks like I can successfully generate the hash password & inserted into my DB (screen shot below). My biggest problem is validating user login & checking if both values match. Been trying for days without success and wondering if I can get some help from this forum.
Below is the function I created to hash a password when users register to my site:
<CFFUNCTION name="generateHash" access="public">
<cfargument name="UserPassword" required="TRUE" type="String">
<cfset Salt = GenerateSecretKey( 'AES' , '256' )>
<cfset Iterations = randRange( 50000 , 100000 , 'SHA1PRNG' )>
<cfset Hash= generatePBKDFKey('PBKDF2WithHmacSHA1', arguments.UserPassword, Salt, Iterations, 128)>
<cfset HashedPassword> = Iterations & ':' & Salt & ':' & Hash>
<CFRETURN HashedPassword>
</CFFUNCTION>
This is how it looks like when the return value was inserted into MS SQL

My effort in validating the password upon user login & checking it whether or not this password matches with the one stored in db is my biggest issue. So far, my logic (If I understood it correctly) is as follow:
1st: I need to get the user login (form.password) and hashing it the same way using the above function eveytime a user is login in.
2nd: Then I need to query the hash password from db
3rd: Next I need to compare both values. But I don't quite understand what should I do with the salt and iteration values which I assume will be different(?).
Can any one from this forum be kind enough to show me some working example that can help me understand how this should work? Thank you
