Timeline for Does too long a salt reduce the security of a stored password hash?
Current License: CC BY-SA 3.0
5 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Dec 21, 2014 at 17:24 | comment | added | Andrew Philips | A monotonically increasing sequence is guaranteed to be globally unique (1, 2, 3, ...). I don't think this is the "only property" that's important. Use a randomly generated Salt the same length as the password hash and you're highly likely to not only have a system-wide unique salt, but a world wide unique salt. | |
| Nov 26, 2014 at 19:54 | history | edited | TildalWave | CC BY-SA 3.0 |
deleted 4 characters in body
|
| Nov 26, 2014 at 16:24 | comment | added | Taemyr | @mxkenzm globally unique will start to be likely if the numbers of potential salts are greater than the square of the number of passwords. For the forseeable future 128 bits should be plenty for this purpose. | |
| Nov 26, 2014 at 1:26 | comment | added | mckenzm | Globally Unique may not be practical for large populations, but agreed "for all intents" and purposes. If I am wearing a black hat I have some (or many) of the passwords already, and may even have salts. Breaches due to poor passwords or poor password usage will sail through as your own system oks them. Randomizing the user name / email helps. But this has to be done from the user side. Sadly many use the same values or derivatives for life. Ultimately we are heading toward 3rd party authentication so that separation of duties are enforced. If SSL/RSA cannot be trusted where are we ? | |
| Nov 25, 2014 at 21:13 | history | answered | Xander | CC BY-SA 3.0 |