How to encrypt user passwords without symfony security?

@jerad 

Encrypting user passwords is a critical step in ensuring the security of a system. While Symfony Security provides convenient and powerful tools for password encryption, it is possible to encrypt user passwords without using Symfony Security. Here's a general approach to encrypt user passwords:

1. Choose a strong hashing algorithm: The first step is to select a secure and widely accepted cryptographic hashing algorithm. Popular choices for password hashing include bcrypt, Argon2, and PBKDF2. These algorithms are specifically designed for password hashing and provide built-in resistance against brute-force and dictionary attacks.
2. Generate a salt: A salt is a random string that is combined with the password before hashing. The purpose of the salt is to add uniqueness to each password hash, even if two users have the same password. This protects against precomputed hash tables (rainbow tables) or other forms of precomputation attacks. Generate a random salt for each user and store it alongside the hashed password.
3. Combine the salt and password: Append the generated salt to the end of the user's password.
4. Hash the combined string: Use the chosen hashing algorithm to generate a secure hash of the combined password and salt string. The resulting hash should be a fixed length.
5. Store the hash and salt: Save the generated hash and the salt in your database or any persistent storage. Make sure to keep the salt securely separate from the hash to maintain the integrity of the encryption process.
6. Verify passwords during login: When a user tries to log in, retrieve their stored password hash and salt from the database. Combine the provided password with the retrieved salt using the same procedure as in steps 3 and 4. Compare the resulting hash with the stored hash. If they match, the password is correct; otherwise, it is incorrect.

It's important to note that implementing password encryption is a complex task, and it is highly recommended to use established libraries or frameworks (like Symfony Security) that have already implemented secure password handling mechanisms. These libraries have been thoroughly reviewed and tested by security experts, reducing the potential for vulnerabilities.