what is the criteria to choose encryption algorithm for my system

Question

I am working on a system which is going to be applied in the real environment. I need to make high security mechanism for the system, one of them is encryption for user's passwords in my database.

I prefer to use one way encryption method to two way encryption, the problem is I want to choose a good algorithm which has good performance and have reasonable reasons to convince my partners why i choose one algorithm instead of other.

Can you give me some tips for doing that?

Answer 1

i don't know what kind of argument you're looking for but :

SHA is a good one-way hash functions.

http://en.wikipedia.org/wiki/Secure_Hash_Algorithm

Edit :

• I'm using Bcrypt but maybe you should look at Scrypt (http://www.unlimitednovelty.com/2012/03/dont-use-bcrypt.html)

Answer 2

Don't just use a simple one-way hash.

Use something like PBKDF2 or bcrypt instead. I'm sure there will be good, free, off-the-shelf implementations available for Java (assuming that they're not already included in the JRE itself).