This question already has an answer here:
- How to store salt? 6 answers
1) As storing passwords in plain text in databases are not secure and so is not a good practice.
password stored in db = "abcde" (plain text)
2) To avoid this, passwords are stored after being hashed using some reliable hashing techniques like SHA256 or SHA 512 etc.
password stored in db = SHA256("abcde") = 36bbe50ed96841d10443bcb670d6554f0a34b761be67ec9c4a8ad2c0c44ca42c
3) But since hashed passwords are vulnerable to rainbow table attacks or dictionary attacks, a new technique of salting is applied. Here a salt (some string) is added(normally prefixed or suffixed) to password and then the resulting password+salt is hashed and stored in db.
password + salt = "abcde" + "catsarecool" and
password stored in db = SHA256("abcdecatsarecool") = 8A85335AB6B09405FF34DCC146A0B690A3BFA834B8C53EBAD77F64C653A89F82
Now I can explain/ask about what I want to confirm and the worries I have -
1) when using salting(3), i would guess that the salt string should also be stored in the DB. Please confirm?
2) If the salt string has to be stored in DB, what's the best practice - using a common salt for all users of application or one salt per user.
3) a) The whole purpose of hashing was that any attacker obtaining the DB dump will be able to see the passwords in plain text which is less secure than when hashed.
b) And the purpose of salting is to make this job more difficult by making dictionary or rainbow table attacks impossible as the attacker will also have to make a guess for "salt" along with password. But if a attacker is able to obtain DB dump somehow, then the attacker would have the "salts" also which, if stored in db, are stored as plain text. So now that the attacker knows the "salt", is not his job of cracking the password just as difficult as it was when he was trying to crack hashed passwords.
I am not a security expert but I am aware that for storing passwords, slower techniques like bcrypt or scrypt or PBKDF2 will be more appropriate. Comments on these or other techniques which are best for storing passwords are welcome. But I am concerned about above scenario for learning purpose? So kindly share your thoughts.