A salt is a random addition to a password to make the hashed password less susceptible to a lookup table attack

learn more… | top users | synonyms

3
votes
1answer
101 views

OS login password: How does it work?

I am making an application to create a password for a user. I am a bit baffled over how it all works though. Namely I want to be sure that my application will store the correct hash so the user can ...
3
votes
2answers
633 views

Determine salt length from hash

I am writing a basic Unix password cracker in Python that would work for MD5, SHA-1 and SHA512. I know that the salt in MD5 correspond to the 2 first chars of the encrypted password, and thus I ...
4
votes
1answer
77 views

Protect password/authenticating during transit over (insecure) TCP socket for a game

Background I am designing a multi-player game with a single server that handles multiple worlds. Each player logs into the server initially before requesting which world to join. The server has a ...
-4
votes
1answer
41 views

How to find an encryption algorithm between two hexadecimal numbers? [closed]

I have several numbers that are generated by a server. They are 16 digits long and are hexadecimal. I have no idea whether or not any salting or hashing techniques were used. Can I find the encryption ...
2
votes
1answer
55 views

Do password derived encryption keys need to be salted?

If I have a database where I store users' sensitive information, and encrypt that information, do I need to do something like PBKDF2(password,salt,10^5) for the encryption key as well as the hash?
2
votes
1answer
111 views

Reverse engineering of a global hash salt from known plaintext and hash

First of all i'm not asking what is a hash, or something else. I will try to explain what i'm searching clearly: Let's say I have a dump of a database, all the passwords of this database are hashed, ...
2
votes
3answers
140 views

How does a hash which contains algorithm to choose can be secure?

I was thinking about creating my own hash+salt function, something like sha1(password + md5(login)), then I read here (part 4) that creating it's own hash+salt function is a bad idea, because if the ...
3
votes
0answers
45 views

Forcing new password with zero-knowledge proof authentications

Let's say a ZKP (e.g. SRP6a) is used, for password verification. Let's say I need to force a user to change their password (so I have the salt and the verifier for the current password). For this, ...
2
votes
2answers
86 views

Guid salt - string vs bytes[]

Recently I got into passwords hashing (SHA256, HMAC-SHA1, PBKDF2, etc.) and one "statement" I've been reading over and over again, stuck in my mind and I can not find a satisfying answer. "When we ...
3
votes
3answers
56 views

where to store the salt for “crypto_pwhash” in a web application with no local storage

I am developing a web application which stores encrypted data on a server. I want to derive the encryption key as well as the login key from a single user password, so I want to use libsodiums ...
5
votes
5answers
2k views

Salted password + hash - is it really useful? [duplicate]

I am new to the topic and wanted to know the concept of having salted hashes before going down to the technical details. From what I have understand password - plaintext hash password - plaintext ...
25
votes
4answers
4k views

What should be used as a salt?

I always hear that it is best to use salts on top of stored passwords, which then somehow gets concatenated and hashed afterwards. But I don't know what to use as a the salt. What would be a good ...
2
votes
1answer
94 views

How to implement encrytion/decryption system using IV between mobile app and web service

In my app we are going to send encrypted data to the web service. I am using the following code to encrypt and decrypt the data - public class DecEn { private static final String password = ...
1
vote
1answer
190 views

Publicly Available API + Sensitive ID/Key Transmission Over HTTP

I've run into a predicament... I'm developing a mobile application that utilizes a server for various things. One portion is that it stores an id/key pair related to accessing and processing ...
1
vote
1answer
40 views

Can a salt maintain pseudo-randomness after being modified?

TL;DR: How much can a function (such as the one below) modify an initially random string before that string becomes useless as a salt for password hashing? Is there a general rule? # Function ...
0
votes
1answer
54 views

Can you resalt hash/rainbow tables after finding the salt for something?

After a rainbow/hash table is salted, is it possible to resalt it after finding the correct salt instead of generating it all over again? If not, what is preventing you from doing so? How can you find ...
1
vote
1answer
63 views

Using username as salt safe enough? [duplicate]

Instead of creating a separate salt generator for each user, can't I just use their username as a salt? It would be unique for everyone, and achieves the purpose of the salts. <?php ...
6
votes
2answers
218 views

Do I REALLY need to change my LastPass password?

Last weekend LastPass' network was compromised and that a list of email addresses along with the hashes of the master passwords were stolen. It is being recommended that LastPass users change their ...
5
votes
5answers
887 views

How secure is it to keep the salt with the password hash? [duplicate]

In Linux we have the salt just next to the password hash in the /etc/shadows file. I always hear that salt value prevents hashed passwords from being cracked by brute force methods. But if somehow we ...
1
vote
4answers
257 views

Why is a password accompanied by a username deemed 'safer'?

While browsing this community I notice that some people say that the main advantage of usernames accompanied by passwords is as they take more tries to be brute forced, however I don't think that is ...
13
votes
6answers
2k views

Does prepending a salt to the password instead of inserting it in the middle decrease security?

I read somewhere that adding a salt at the beginning of a password before hashing it is a bad idea. Instead, the article claimed it is much more secure to insert it somewhere in the middle of the ...
3
votes
1answer
142 views

Is this symetric or asymetric encryption?

I’m at the beginning of my journey into the world of security. I am reading about the most fundamentals topics and I have encountered something unusual that has thrown me. The Conundrum: I have come ...
3
votes
3answers
286 views

Are credit card number look ups more secure with a hash function than with a deterministic encryption algorithm?

I understand PCI DSS 3.0 allows hashes of cardnumbers to be stored separately from encrypted values, but I'm startled at the efficiency of tools like hashcat in discovering card numbers from hashed ...
1
vote
2answers
142 views

Is it possible to crack hash with known salt? If yes how?

Hello folks, I was wondering , if the salt in the hash is known to us,then is it possible to crack to extract the password from the hash? If Yes, How?
19
votes
2answers
5k views

How big should salt be?

I will be using scrypt to store passwords in my application. As such, I'll be using SHA-256 and Salsa20 crypto primitives (with PBKDF2). Having that in mind, how big salt should I use? Should it be ...
0
votes
1answer
61 views

MySQL Database Password protection

I am developing an industry-level web server that requires that all passwords be encrypted in some way. The middle-ware for the server is Java-based. My only restriction is that I can't use API's ...
2
votes
1answer
129 views

Securely storing passwords using PHP5

Starting note: After going through some articles and answers posted on SO related to storing secured passwords I'm still not sure whether my way of thinking is applicable to todays reality. I'm ...
1
vote
2answers
58 views

Salt addition in hashing? [duplicate]

I may be wrong here but reading about salt I was wondering whether if we use the same salt for every password saved in our database won't users having same password would lead to same hash even after ...
0
votes
0answers
9 views

Does a static salt in addition to a random one add any security? [duplicate]

I'm looking through some old hashing code and found something that made me raise an eyebrow. In order to store passwords, it uses BCrypt to generate a random salt and hash the password. Before that, ...
0
votes
2answers
141 views

Is my hashing function good enough

Is there an obvious flaw with this hashing function (written in PHP)? function hash($password) { sleep(1); // Make hashing slow $hash = ""; $iterations = strlen($password); for ( $i = 0; $i ...
5
votes
2answers
4k views

Should I use urandom() or openssl_random_pseudo_bytes()?

I am developing a site in PHP 5.4. Which function is better to use to generate a random salt for password security? $salt = sha1(openssl_random_pseudo_bytes(23)); or $seed = ''; $a = ...
96
votes
6answers
37k views

Password Hashing add salt + pepper or is salt enough?

Please Note: I'm aware that the proper method for secure password storage hashing is either scrypt or bcrypt. This question isn't for implementation in actual software, it's for my own understanding. ...
6
votes
3answers
259 views

Image file as password alternative

I seek guidance on interesting issue. Recently I've been searching for password alternatives, not because of the security, but to be more user-friendly. In one of my projects user receives 128 bits ...
23
votes
7answers
7k views

Why don't people hash and salt usernames before storing them

Everyone knows that if they have a system that requires a password to log in, they should be storing a hashed & salted copy of the required password, rather than the password in plaintext. What I ...
14
votes
6answers
3k views

Do salts have to be random, or just unique and unknown?

First of all, my motive is to avoid storing the salt in the database as plain text. As far as this question is concerned, the salt is not stored in the database. After discussion in comments and in ...
33
votes
7answers
9k views

Is salting a hash really as secure as common knowledge implies?

(I did search on this topic, but I found no complete question/answer that addressed it, or even good portions of questions that might be relevant.) I'm implementing a salt function for user passwords ...
4
votes
1answer
614 views

Is it a good idea to use two salts? [duplicate]

Is it a good idea to use two salts? This is implying that one would be unique to the user, and one would be unique to the server, using Bcrypt of course. So for example, if you're using Golang as ...
1
vote
2answers
134 views

Is bruteforcing the last character of a salt a good idea?

Would it be a good idea security-wise to store salts with their last character removed, and then bruteforce the last character to further the amount of time it would take to create rainbow tables and ...
1
vote
2answers
102 views

Hashing password with salt [duplicate]

I read from wiki: The attacker has access to both the hashed password and the salt, so when running the dictionary attack, the attacker can simply use the known salt when attempting to crack the ...
14
votes
6answers
2k views

What are the differences between an encryption seed and salt?

Today I had a hard time explaining the difference to a friend. I know seeds are used when generating "random" strings. And salts are used when providing different outcomes to a hash. What is a ...
1
vote
3answers
105 views

How to compare passwords with duplicate password

On Steam, the gaming client, I have this habit of creating multiple "smurf" accounts. I have a randomly-generated, unique password, and I decided to use the same password for all of my multiple ...
2
votes
1answer
234 views

Crackstation “Secure Salted Password” Java example - is it really secure?

I'm making an auth service so I've been looking for some good Java/Groovy implementations of password + salt hashing. I've found this article on crackstation along with a code example and decided to ...
3
votes
5answers
385 views

Are all unsalted password hashes inherently insecure?

Maybe I'm missing something obvious... Are all passwords stored in common, unsalted hash algorithms able to be attacked via rainbow tables?
1
vote
1answer
73 views

Storing salt and hashed password [duplicate]

Is there a benefit to storing salt appended to hashed password in a single column of a table verses storing salt and hashed password in different columns of the table. The OWASP guide here ...
242
votes
7answers
38k views

How to store salt?

Nowadays, if we expect to store user password securely, we need at least do the following thing $pwd=hash(hash($password) + salt) then store $pwd in your system instead of the real password. I have ...
1
vote
2answers
59 views

One-way function for data synchronisation

I have to synchronise small sets of data between two or more systems over an insecure network. First I have to check that the other system has the same unique identification information for the data ...
11
votes
2answers
1k views

How can I find out the password hashing schemes used by the specific Unix accounts I log in to?

Every day I ssh in to 3 or 4 independent Unix accounts. I have been regarding them as more or less "equivalently secure" on the grounds that I'm using ssh, but after learning of how much variety ...
0
votes
2answers
77 views

Is it safe to use a derivative of a password as a salt

I know for a fact that salts are an important part of storing a password securely in a database. Most people store the password hash, and the salt that was used for it. This, I have learned, isn't ...
20
votes
5answers
4k views

Does too long a salt reduce the security of a stored password hash?

Suppose we have passwords that are statistically 7-8 characters long. Is appending a 200 character long salt less secure than a 5 character salt, because of the similar hash function inputs? I was ...
0
votes
2answers
131 views

Separate database column for salt

Is it advisable to store the salt in a separate database column or should we concatenate it together with the password? Is there any difference? I have come across implementations of both types. ...