Tag Info

New answers tagged

1

Simply put, the purpose of the salt is to make hash different for the same password. hash('password') == hash('password') // same password, same hash hash('password'+salt#1) != hash('password'+salt#2) // avoid hash collision with salt Now let's take your approach and expand it. It is equivalent to: finalHash = ...


1

Your "salt" doesn't seem to provide any of the benefits that are the point of using a salt. Using your scheme, each password only produces a single output, so an attacker knowing your scheme (which you must assume they do) can easily produce a rainbow table of possible hashes to match against those in your database. A salt is supposed to prevent this, ...


4

Short answer: don't do it. Salt should be used to provide some security against leaked hashed passwords, since the same password will have the same hash, when unsalted. If salt is predictable, there is no gain. Since you're not adding any entropy by doing that, there is no gain by doing that kind of thing. And since you're using a very small number of ...


16

Don't do it. Salts have to be unique, that's their only requirement. But your approach doesn't generate unique salts, but password-dependent ones. A per-db-unique salt helps when its long enough (256 bits), and you also hash in the username, but that still leaves issues. Having only 3 iterations of SHA256 is rather not the way password hashes should be, ...



Top 50 recent answers are included