Not sure i understand your reply at the moment, but i will definitely try. We are using RSA. The public key is on the server. We simply using RSA as a "hashing

Not sure i understand your reply at the moment, but i will definitely try. We are using RSA. The public key is on the server. We simply using RSA as a "hashing algo". Randomly generated salt is added to the password sent by the user to make the password (much) longer as well as strengthen it before the encryption takes place. I have explained the reasons for storing the passwords (for the time being, hopefully temporarily) in other replies in this comment branch: quote: There's no argument from me regarding undesirability of keeping the passwords. But we also have a different concern - we don't want to be in the business of authentication at all - our goal is to have a third party service or appliance performing authentication and forwarding us already authenticated sessions with the user name as a header, for instance. Our desired end-state - is when we do not have any knowledge of or access to credentials used by the end-user. To enable us to make this transition possible - for the time being we store the passwords, since as i explained in another reply, we must make this transition transparent to the users and we have legitimate users that login once a year (think credit report, just an example, not our business), so we can't intercept the credentials within a reasonable time period. /quote