2

I am storing in my database the user password hash and salt.

I would like to know if putting together hash and salt in the same field is adding complexity to a potential hacker who had access to the database?

Like this:

h:hash and S:salt
hhhhhhhhhhhhhhhhSSSS

And even like this:

hhShhhhhSShhhhShhShhhh

Positions of salt octets will be chosen arbitrary, and hash and salt will be reconstructed at runtime.

Is it useful? Or completely useless?

4

Having the salt and the password together is pretty common, bcrypt uses something similar. The hash returned by bcrypt has the following format

$prefix$cost$salt+hash

About the scrambling, while it may give you some kind of protection against most attackers, it's just adding security through obscurity. As far as the attacker doesn't know how are you scrambling the result it will give some protection, but once the attacker knows that it won't give any protection

In general, security through obscurity is not recommended as the only security layer, but in this case it's an additional one over good password hashing practices (I'm assuming you use bcrypt or some equivalently secure password hashing algorithm). But IMO, a better security improvement can be obtained increasing the cost/iterations of the hashing function used

| improve this answer | |
  • 2
    Concur on the obscurity. There are some hashing-contest people who are extremely good at figuring out all sorts of complex obfuscation. Go simple and strong, or go home. :) – Royce Williams Aug 3 '17 at 18:42
0

I'd say this is good hardening however not something to rely on.

Proper practises such as using a slow-hash algorithm (bcrypt) and securing your server are much more important.

If somebody has access to your server they can likely work out how the hash and salt are arranged within the string.

If only the strings were leaked, it would be significantly harder to brute force since they would not be valid hashes.

Creative idea though, I like it.

| improve this answer | |
  • 1
    Thanks for the answer, but a I can't upvote any of you because my Reputation is lower than 15... – Carl Sagan Aug 3 '17 at 19:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.