If a salt is not stored along with the hashed password in the database, is it possible that the password is salted?
I ask because in a system I am working on there is only a password column, but when I review the code it appears that whoever wrote this is attempting to salt the password.
From what I understood passwords/salts are supposed to be stored like below:
email | password (hashed) | salt (not hashed)
[email protected] | de898928393a893sfe7f98s7 | S#ne3
So when a user registered with their password ("froggy" in the example below) it would go something like this:
//Generate salt (S#ne3 for this example)
//encrypt ("froggy" + "S#ne3")
//Save encrypted pw + salt to database AND save unencrypted salt to database
Then when the user attempted to login with "froggy" it would go something like this:
//Query database for user's record. Store this in curUser object
//Check to see if the following match: encrypt("froggy" + curUser.salt) == curUser.password
Does this sound right? If I am right, is it safe to assume that passwords on this system are not salted?
hash-type$salt$hash
(look e.g. at the hash bcrypt gives you)