A salt is a random addition to a password to make the hashed password less susceptible to a lookup table attack
121
votes
7answers
8k views
How to store salt?
Nowadays, if we expect to store user password securely, we need at least do the following thing
$pwd=hash(hash($password) + salt)
then store $pwd in your system instead of the real password. I have ...
34
votes
4answers
11k views
Password Hashing add salt + pepper or is salt enough?
Please Note: I'm aware that the proper method for secure password storage hashing is either scrypt or bcrypt. This question isn't for implementation in actual software, it's for my own understanding.
...
15
votes
4answers
1k views
Why is using salt more secure?
Storing the hash of users' passwords, e.g. in a database, is insecure since human passwords are vulnerable to dictionary attacks. Everyone suggests that this is mitigated via the use of salts, but the ...
17
votes
4answers
1k views
What should be used as a salt?
I always hear that it is best to use salts on top of stored passwords, which then somehow gets concatenated and hashed afterwards. But I don't know what to use as a the salt. What would be a good ...
25
votes
8answers
2k views
Why would salt not have prevented LinkedIn passwords from getting cracked?
In this interview posted on Krebs on Security, this question was asked and answered:
BK: I’ve heard people say, you know this probably would not have
happened if LinkedIn and others had salted ...
9
votes
2answers
2k views
What are the most common password salting methods?
I learned that the Sun guys used the login name as salt for password hashing. Is this a common approach?
What are the most common salt values?
8
votes
1answer
284 views
Any risk in using the same salt for several hashes on a user?
Right now I'm storing a salt and password_hash on the users table (pretty standard stuff).
The need arose to get a secure hash of another field for a user. Is there any risk in reusing the same salt ...
1
vote
3answers
440 views
Recompute Rainbow table with salt?
So, as I understand it, you prepend a password with salt before you hash it so that the resulting hash can't be used with a rainbow table to find the original password, as you could if the password ...
33
votes
7answers
2k views
“Real” Salt and “Fake” Salt
During a Q&A period at DEFCON this year, one member of the audience mentioned that we're using "fake salt" when concatenating a random value and a password before hashing. He defined "real salt" ...
22
votes
7answers
3k views
Is salting a hash really as secure as common knowledge implies?
(I did search on this topic, but I found no complete question/answer that addressed it, or even good portions of questions that might be relevant.)
I'm implementing a salt function for user passwords ...
17
votes
4answers
972 views
When hashing passwords, is it ok to use the hashed password as the salt?
I don't like this idea. But I can not come up with a technical argument against it. Can somebody explain it to me? The basic idea is:
$passwd = 'foo';
$salt = hash($passwd);
$finalHash = hash($passwd ...
8
votes
2answers
1k views
How big salt should be?
I will be using scrypt to store passwords in my application. As such, I'll be using SHA-256 and Salsa20 crypto primitives (with PBKDF2).
Having that in mind, how big salt should I use?
Should it be ...
9
votes
3answers
773 views
What is a good enough salt for a SaltedHash?
Since I'm hashing all passwords with each their own salt, is there a benefit to the salt being really random, or would an incremental counter or a guid be good enough? Also, is there a benefit of ...
3
votes
3answers
493 views
optimal way to salt password?
A good way to salt password?
I have read a few answers related to salting password. But I started to get confused.
I came across few functions people used to generate salt like:
mcrypt_create_iv()
...
8
votes
6answers
553 views
Does prepending a salt to the password instead of inserting it in the middle decrease security?
I read somewhere that adding a salt at the beginning of a password before hashing it is a bad idea. Instead, the article claimed it is much more secure to insert it somewhere in the middle of the ...
