Reputation
1,176
Top tag
Next privilege 2,000 Rep.
Edit questions and answers
Badges
8 11
Newest
 Yearling
Impact
~32k people reached

  • 0 posts edited
  • 1 helpful flag
  • 42 votes cast
May
21
awarded  Yearling
May
21
awarded  Yearling
May
21
awarded  Yearling
May
21
awarded  Yearling
Dec
29
awarded  Enlightened
Dec
29
awarded  Nice Answer
Dec
29
awarded  Good Answer
Nov
11
awarded  Critic
Nov
10
awarded  Necromancer
Jul
12
revised Salting password with the first 8 bit of the password itself
deleted 71 characters in body
Jul
12
comment Salting password with the first 8 bit of the password itself
@Peter, I believe I've addressed your concern, while retaining my original answer that assumed storage of the salt.
Jul
12
revised Salting password with the first 8 bit of the password itself
Added notes on cryptographic properties for salts
Jul
12
revised Salting password with the first 8 bit of the password itself
Added notes on cryptographic properties for salts
Jul
12
revised Salting password with the first 8 bit of the password itself
Added notes on cryptographic properties for salts
Jul
12
comment Salting password with the first 8 bit of the password itself
@Peter, see my comment to Paul's answer. I'm aware of the fact that the salt need not stored. That itself means that a hash chain computation is feasible, and that the salt has lost it's property of being a cryptographic salt.
Jul
12
comment Salting password with the first 8 bit of the password itself
@Mohamed, read the last sentence in the answer - If the salt is computed from the password itself instead of being randomly generated, then two accounts with the same password will always have the same password hash. If you are not storing the salt and if you are deriving it from the password, the hashes generated for two users will be the same if they have the same password (which is the scenario that salts are meant to prevent).
Jul
12
awarded  Nice Answer
Jul
12
comment Salting password with the first 8 bit of the password itself
+1 for pointing out the loss of protection against rainbow tables. Of course, the attacker must still compute the tables as opposed to using a downloaded set of hashes, but he must do it only once.
Jul
12
revised Salting password with the first 8 bit of the password itself
Removed incorrect wording on entropy calculation
Jul
12
revised Salting password with the first 8 bit of the password itself
added 23 characters in body