Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Possible Duplicate:
Password Hashing add salt + pepper or is salt enough?
Any risk in using the same salt for several hashes on a user?

It's known that all password hashes need to be salted, but a debate often arises which salting strategy to use:

  • One common salt, hard-coded in the application away from the data
  • One salt per one hash, stored in the database next to the hash, never reused

How do these two approaches compare against different attacks or leaks? Is one more secure than the other?

share|improve this question

marked as duplicate by D.W., Gilles, Polynomial, AviD Aug 8 '12 at 13:47

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

1  

1 Answer 1

up vote 3 down vote accepted

There is tons already written on this site about salting. Please go read that, and then come back if you have further questions. Don't miss Password Hashing add salt + pepper or is salt enough?.

TL;DR: Each user should receive their own individual random salt, stored in the database, next to the hash. You could optionally also include a second application-wide salt ("pepper") stored elsewhere, but it's not critical.

share|improve this answer
    
So the two approaches I've mentioned are actually referred to as pepper and salt, respectively, and the first should only be used as a supplement to the other. –  Kos Aug 8 '12 at 9:27

Not the answer you're looking for? Browse other questions tagged or ask your own question.