Jacco

1,287 reputation

1614

bio	website	traveljournal.net
	location	Netherlands
	age
visits	member for	2 years, 1 month
	seen	Jan 31 at 11:06
stats	profile views	106

The more I learn about security, the more I realise I don't know anything about the subject.

	1,287 reputation	bio	website	traveljournal.net	visits	member for	2 years, 1 month
1614 badges		location	Netherlands		seen	Jan 31 at 11:06

summary answers questions tags badges favorites bounties reputation activity

161 Actions

suggestions reviews revisions comments badges posts accepts all

May 14	awarded	Critic
May 14	revised	Password Hashing add salt + pepper or is salt enough? edited tags
May 12	awarded	Teacher
May 10	comment	How to securely hash passwords? @nealmcb, The OpenBSD implementation of BCrypt, as deployed as part of the operating system, has built in salts (as do some JAVA implementations). This salt salting is handled by the implementation specific wrapper/helper functions. The CodaHale.com article takes the Provos & Mazières paper (dealing with the OpenBSD implementation) out of it's context and suggests that the BCrypt hashing algorithm has build in salts. This is a false suggestion; the BCrypt hashing algorithm itself does not have build-in salts.
Apr 26	revised	Surfing anynomously added 1 characters in body
Apr 26	answered	Surfing anynomously
Apr 26	suggested	suggested edit on Possibility of undetectable encryption system
Apr 23	comment	Password Hashing add salt + pepper or is salt enough? Hmm, the edit removed the much of the uncertainty present in the answer as written by @Jesper Mortensen. Maybe the edit should be rolled back and moved to a separate answer?
Apr 23	revised	Password Hashing add salt + pepper or is salt enough? Removed the "PBKDF2". see also: http://security.stackexchange.com/questions/2051/is-pbkdf2-based-system-cryptology-rfc2898derivebytes-better-for-unicode-passw/2056#2056; deleted 1 characters in body
Apr 22	comment	Password Hashing add salt + pepper or is salt enough? I'm trying to wrap my brain around "Adding a key the hash transforms it into a MAC". Am I correct in understanding that, by adding a constant value (along with the password and salt) into the hashing algorithm, the changed use of the primitive affect the stength of the outcome? And that, if the key is known, the overall scheme is likely to be less secure?
Apr 22	revised	Password Hashing add salt + pepper or is salt enough? edited body
Apr 22	awarded	Student
Apr 22	revised	Password Hashing add salt + pepper or is salt enough? added 6 characters in body
Apr 22	revised	Password Hashing add salt + pepper or is salt enough? added 9 characters in body
Apr 22	comment	How to securely hash passwords? The article linked by @Rory McCune is, as far as I know, flawed in suggesting that using BCrypt makes salting unnecessary. This is not true and based on his misinterpretation of the Provos & Mazières paper linked by him.
Apr 22	revised	Password Hashing add salt + pepper or is salt enough? deleted 12 characters in body
Apr 22	comment	Password Hashing add salt + pepper or is salt enough? @Marcin, No, I'm asking exactly what's written in the question. I'm not interested in the purpose of the salt. I'm looking for the possible increase in security by adding a secret key to the hash.
Apr 22	awarded	Editor
Apr 22	revised	Password Hashing add salt + pepper or is salt enough? added 166 characters in body; added 201 characters in body
Apr 22	asked	Password Hashing add salt + pepper or is salt enough?