I apologize for being naive, but I only recently started learning about cryptography and how to go about the security online.
From what I've gathered, the safest-without-sacrificing-efficiency way to securely store a password is to add a pepper, generate a random salt, and then hash all three (password + pepper + salt).
When a user attempts to login, the program would then check to see if the hash matched the hash in the database associated with the username. Since you need a salt (and hard-coded pepper) to hash the password with any hope of success...
- Do you need to try hashing every single salt in your database?
- If you have a million salts, wouldn't that be very slow?
- Is there a better way to do this?
| user_name | hash(pepper|passwd|salt) | salt | ... |
in your users table. The pepper if ever used usually stay in the application server.