Looking for an encrypted mail provider I checked ProtonMail and asked them why do they use “semi-random password salts (one random part, one non-random part)” compared to SRP 6a fully random salt. Got this answer:

The advantage is that in the event another service’s password database is compromised, and the user used the same password on ProtonMail and this compromised third-party service (don’t do this!), and that service uses the same hash algorithm we do, the attacker would not be able to impersonate the ProtonMail server in the SRP auth sequence, because ProtonMail clients know that the salt begins with a non-random sequence and check this, whereas the salt stolen from 3rd party service would not.

Now given that the client is Open Source, what is the point of this? They didn't answer this one. I haven't read the source, so I don't know how it's implemented, but does anybody know how it could enhance auth security?

  • If the salting part is in the open source code, it doesn't offer an true security advantage, maybe a slight edge at thwarting SK attempts, but not from an adversary willing to dig through the codebase.
    – HashHazard
    Commented Mar 1, 2017 at 12:47

1 Answer 1


The point is not that the non-random part of the salt is secret (it's not). The point is that it's non-random. So in the scenario described above, if in the remote chance that a compatible password hash for a user were stolen from a third-party website, and the user used the same password for this website and ProtonMail, the attacker could not impersonate the ProtonMail server in the SRP sequence because the salt would likely not have the specific non-random sequence in it and therefore it would be rejected by the client.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .