1
vote
2answers
82 views

Is it unsafe to hash one password with more than one salt?

I'm asking my question here since I was not able to find an answer anywhere. I have written a piece of software which stores pretty delicate passwords. I have used BCrypt as hashing algorithm with an ...
1
vote
1answer
166 views

Any reason I shouldn't be salting and hashing before putting through bCrypt?

I've been reading up on password storage and such, and have come to the conclusion that I need to be using bCrypt. I've got an implementation working correctly, but I'm wondering the best way to move ...
3
votes
2answers
144 views

Search on encrypted data of multiple users

I want to implement a search over encrypted data. I found a blogpost, which explains 3 methods. One method is to use deterministic encryption, which I'm trying to implement. But my use case is a ...
2
votes
1answer
881 views

How to save the random salt to the database

As I understand it, salting and hashing passwords is the way to go. I also understand that to authenticate a salted and hashed password, the random salt needs to be saved. Does this mean that if I use ...
3
votes
1answer
282 views

Is there a better way to take advantage of current 'approved', 'proven', and memory/cpu-expensive algorithms while using salts and peppers?

I've read about the concepts presented in these two questions: Pre-hash password before applying bcrypt to avoid restricting password length Would it make sense to use Bcrypt and PBKDF2 together? I ...
7
votes
3answers
711 views

Is it secure to use bcrypt-generated salt in cookie to serve as token in place of a password?

I have a (hobby) web site that runs only on SSL. The site does not deal with finances, social security numbers, or anything of that level of importance. However, I'd like to secure it as much as ...
5
votes
3answers
2k views

bcrypt: random salt vs computed salt

I'm pretty new to the whole password hashing business, so I might be missing something obvious. I was looking at the bcrypt algorithm, in particular BCrypt.Net, and I was wondering if it wouldn't be ...
3
votes
5answers
370 views

PCI-DSS and salt storage

PCI-DSS states the following: 3.5 Protect any keys used to secure cardholder data against disclosure and misuse I have a service which stores a salted bcrypt hash of the user's PAN. Assuming the ...