I am storing in my database the user password hash and salt.
I would like to know if putting together hash and salt in the same field is adding complexity to a potential hacker who had access to the database?
Like this:
h:hash and S:salt
hhhhhhhhhhhhhhhhSSSS
And even like this:
hhShhhhhSShhhhShhShhhh
Positions of salt octets will be chosen arbitrary, and hash and salt will be reconstructed at runtime.
Is it useful? Or completely useless?
Having the salt and the password together is pretty common, bcrypt uses something similar. The hash returned by bcrypt has the following format
$prefix$cost$salt+hash
About the scrambling, while it may give you some kind of protection against most attackers, it's just adding security through obscurity. As far as the attacker doesn't know how are you scrambling the result it will give some protection, but once the attacker knows that it won't give any protection
In general, security through obscurity is not recommended as the only security layer, but in this case it's an additional one over good password hashing practices (I'm assuming you use bcrypt or some equivalently secure password hashing algorithm). But IMO, a better security improvement can be obtained increasing the cost/iterations of the hashing function used
I'd say this is good hardening however not something to rely on.
Proper practises such as using a slow-hash algorithm (bcrypt) and securing your server are much more important.
If somebody has access to your server they can likely work out how the hash and salt are arranged within the string.
If only the strings were leaked, it would be significantly harder to brute force since they would not be valid hashes.
Creative idea though, I like it.
