2

Possible Duplicate:
Password Hashing add salt + pepper or is salt enough?
Any risk in using the same salt for several hashes on a user?

It's known that all password hashes need to be salted, but a debate often arises which salting strategy to use:

  • One common salt, hard-coded in the application away from the data
  • One salt per one hash, stored in the database next to the hash, never reused

How do these two approaches compare against different attacks or leaks? Is one more secure than the other?

marked as duplicate by D.W., Gilles, Polynomial, AviD Aug 8 '12 at 13:47

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

6

There is tons already written on this site about salting. Please go read that, and then come back if you have further questions. Don't miss Password Hashing add salt + pepper or is salt enough?.

TL;DR: Each user should receive their own individual random salt, stored in the database, next to the hash. You could optionally also include a second application-wide salt ("pepper") stored elsewhere, but it's not critical.

  • 1
    So the two approaches I've mentioned are actually referred to as pepper and salt, respectively, and the first should only be used as a supplement to the other. – Kos Aug 8 '12 at 9:27
  • @D.W. Can you elaborate on "next to the hash"? I have seen suggestions to store the per-user hash in a separate column as well as the same column as the password. If stored in the same column how do you determine where the salt ends and the pass begins? Have people experimented with mixing them up together in some way to further obfuscate? or is that completely unnecessary? Thanks! – Matthew Sanders Apr 14 at 18:00
  • @MatthewSanders, either is fine, it doesn't matter. You can use any convenient way to represent or encode those pair of values; it's not security-critical. Mixing them up and obfuscation is unnecessary and unlikely to help much. Instead of obfuscation, use a pepper (but don't store it in the database). Make sure to read the link in my answer. – D.W. Apr 14 at 19:58
  • Thanks @D.W. I read through the link you gave and have a better understanding from some other searching as well. I've also been using bcrypt.js in node but didn't fully understand the inner workings. Looks like the answer to my question is that the salt will be a fixed length and thus you can easy append and retrieve it after concatenation. – Matthew Sanders Apr 14 at 20:07

Not the answer you're looking for? Browse other questions tagged or ask your own question.