Skip to main content
Commonmark migration
Source Link

The problem here is that the salt mission isn't to be "secret", the purpose is to be unique so when an attacker "try a password" with that known salt it can only compare the generated pass with this one original hash because all other passwords will have different hashes.

For example:

Consider not having a salt:

user1:hashpass1

 

user2:hashpass2

 

user3:hashpass3

 

user4:hashpass1

 

user5:hashpass5

As you can see, user1 and user4 use the very same password because the hash generated are identical. So, when an attacker find this, he can hash one common word, for example: "rabbit" and then compare rabbit against the whole password hash database. He will also know that all the identical hashes has been generated with the very same password.

This is great for an attacker because he only need to hash ONE time to compare it hash against the whole database.

On the other hand, consider the very same salted user table

user1:salt1:salted1hashpass1

 

user2:salt2:salted1hashpass2

 

user3:salt3:salted1hashpass3

 

user4:salt4:salted4hashpass1

 

user5:salt5:salted1hashpass5

Now all the password hashes are different because of the salt, even user1 and user4 who used the very same password has different hashes.

This is bad news for an attacker he will need to compute the word rabbit with every single salt he finds in the database so he will a lot of time to do this. And this is the real value added by the salt.

The problem here is that the salt mission isn't to be "secret", the purpose is to be unique so when an attacker "try a password" with that known salt it can only compare the generated pass with this one original hash because all other passwords will have different hashes.

For example:

Consider not having a salt:

user1:hashpass1

 

user2:hashpass2

 

user3:hashpass3

 

user4:hashpass1

 

user5:hashpass5

As you can see, user1 and user4 use the very same password because the hash generated are identical. So, when an attacker find this, he can hash one common word, for example: "rabbit" and then compare rabbit against the whole password hash database. He will also know that all the identical hashes has been generated with the very same password.

This is great for an attacker because he only need to hash ONE time to compare it hash against the whole database.

On the other hand, consider the very same salted user table

user1:salt1:salted1hashpass1

 

user2:salt2:salted1hashpass2

 

user3:salt3:salted1hashpass3

 

user4:salt4:salted4hashpass1

 

user5:salt5:salted1hashpass5

Now all the password hashes are different because of the salt, even user1 and user4 who used the very same password has different hashes.

This is bad news for an attacker he will need to compute the word rabbit with every single salt he finds in the database so he will a lot of time to do this. And this is the real value added by the salt.

The problem here is that the salt mission isn't to be "secret", the purpose is to be unique so when an attacker "try a password" with that known salt it can only compare the generated pass with this one original hash because all other passwords will have different hashes.

For example:

Consider not having a salt:

user1:hashpass1

user2:hashpass2

user3:hashpass3

user4:hashpass1

user5:hashpass5

As you can see, user1 and user4 use the very same password because the hash generated are identical. So, when an attacker find this, he can hash one common word, for example: "rabbit" and then compare rabbit against the whole password hash database. He will also know that all the identical hashes has been generated with the very same password.

This is great for an attacker because he only need to hash ONE time to compare it hash against the whole database.

On the other hand, consider the very same salted user table

user1:salt1:salted1hashpass1

user2:salt2:salted1hashpass2

user3:salt3:salted1hashpass3

user4:salt4:salted4hashpass1

user5:salt5:salted1hashpass5

Now all the password hashes are different because of the salt, even user1 and user4 who used the very same password has different hashes.

This is bad news for an attacker he will need to compute the word rabbit with every single salt he finds in the database so he will a lot of time to do this. And this is the real value added by the salt.

added 1 characters in body
Source Link
kiBytes
  • 3.5k
  • 18
  • 26

The problem here is that the salt mission isn't to be "secret", the purpose is to be unique so when an attacker "try a password" with that known salt it can only compare the generated pass with this one original hash because all other passwords will have different hashes.

For example:

  1. Consider not having a salt:

Consider not having a salt:

user1:hashpass1

user2:hashpass2

user3:hashpass3

user4:hashpass1

user5:hashpass5

As you can see, user1 and user4 use the very same password because the hash generated are identical. So, when an attacker find this, he can hash one common word, for example: "rabbit" and then compare rabbit against the whole password hash database. He will also know that all the identical hashes has been generated with the very same password.

This is great for an attacker because he only need to hash ONE time to compare it hash against the whole database.

  1. On the other hand, consider the very same salted user table:

On the other hand, consider the very same salted user table

user1:salt1:salted1hashpass1

user2:salt2:salted1hashpass2

user3:salt3:salted1hashpass3

user4:salt4:salted4hashpass1

user5:salt5:salted1hashpass5

Now all the password hashes are different because of the salt, even user1 and user4 who used the very same password has different hashes.

This is bad news for an attacker he will need to compute the word rabbit with every single salt he finds in the database so he will a lot of time to do this. And this is the real value added by the salt.

The problem here is that the salt mission isn't to be "secret", the purpose is to be unique so when an attacker "try a password" with that known salt it can only compare the generated pass with this one original hash because all other passwords will have different hashes.

For example:

  1. Consider not having a salt:

user1:hashpass1

user2:hashpass2

user3:hashpass3

user4:hashpass1

user5:hashpass5

As you can see, user1 and user4 use the very same password because the hash generated are identical. So, when an attacker find this, he can hash one common word, for example: "rabbit" and then compare rabbit against the whole password hash database. He will also know that all the identical hashes has been generated with the very same password.

This is great for an attacker because he only need to hash ONE time to compare it hash against the whole database.

  1. On the other hand, consider the very same salted user table:

user1:salt1:salted1hashpass1

user2:salt2:salted1hashpass2

user3:salt3:salted1hashpass3

user4:salt4:salted4hashpass1

user5:salt5:salted1hashpass5

Now all the password hashes are different because of the salt, even user1 and user4 who used the very same password has different hashes.

This is bad news for an attacker he will need to compute the word rabbit with every single salt he finds in the database so he will a lot of time to do this. And this is the real value added by the salt.

The problem here is that the salt mission isn't to be "secret", the purpose is to be unique so when an attacker "try a password" with that known salt it can only compare the generated pass with this one original hash because all other passwords will have different hashes.

For example:

Consider not having a salt:

user1:hashpass1

user2:hashpass2

user3:hashpass3

user4:hashpass1

user5:hashpass5

As you can see, user1 and user4 use the very same password because the hash generated are identical. So, when an attacker find this, he can hash one common word, for example: "rabbit" and then compare rabbit against the whole password hash database. He will also know that all the identical hashes has been generated with the very same password.

This is great for an attacker because he only need to hash ONE time to compare it hash against the whole database.

On the other hand, consider the very same salted user table

user1:salt1:salted1hashpass1

user2:salt2:salted1hashpass2

user3:salt3:salted1hashpass3

user4:salt4:salted4hashpass1

user5:salt5:salted1hashpass5

Now all the password hashes are different because of the salt, even user1 and user4 who used the very same password has different hashes.

This is bad news for an attacker he will need to compute the word rabbit with every single salt he finds in the database so he will a lot of time to do this. And this is the real value added by the salt.

Source Link
kiBytes
  • 3.5k
  • 18
  • 26

The problem here is that the salt mission isn't to be "secret", the purpose is to be unique so when an attacker "try a password" with that known salt it can only compare the generated pass with this one original hash because all other passwords will have different hashes.

For example:

  1. Consider not having a salt:

user1:hashpass1

user2:hashpass2

user3:hashpass3

user4:hashpass1

user5:hashpass5

As you can see, user1 and user4 use the very same password because the hash generated are identical. So, when an attacker find this, he can hash one common word, for example: "rabbit" and then compare rabbit against the whole password hash database. He will also know that all the identical hashes has been generated with the very same password.

This is great for an attacker because he only need to hash ONE time to compare it hash against the whole database.

  1. On the other hand, consider the very same salted user table:

user1:salt1:salted1hashpass1

user2:salt2:salted1hashpass2

user3:salt3:salted1hashpass3

user4:salt4:salted4hashpass1

user5:salt5:salted1hashpass5

Now all the password hashes are different because of the salt, even user1 and user4 who used the very same password has different hashes.

This is bad news for an attacker he will need to compute the word rabbit with every single salt he finds in the database so he will a lot of time to do this. And this is the real value added by the salt.