Is there any benefit to use different salt for different encryption algorithms for same user

Question

There is two different passwords for a single user. I'm hashing both for future validation. I'm currently using a single unique salt for the user, but each is hashed with a different algorithms (PBKDF2 with different algorithm and different interation counts).

Is there any benefit to also use separate salts for each of the hashes? or is the different algorithm enough? My understanding is that the hash algorithm change effectively requires an attacker to generate a unique rainbow table for collision attack, so two salt seems overkill, and just adds to management overhead.

Answer 1

The salt is usually quite visible to a hacker. It doesn't protect you by being unknown, it protects you by making your combination (salt + password) unique.

Without a salt, you have two risks: If you use a password with low entropy, then someone else might use exactly the same password, and a hacker can find there are two users with the same password. That makes it likely that both users are using a weak password, so it's a good target for password cracking. With everyone using different salts, a hacker cannot identify weak passwords.

And you can buy "rainbow tables", that is a database of password hashes. Without salt, your password which has intermediate strength might be found in a rainbow table with very little effort. With everyone using a different salt, that is not the case.

So which salt you are using isn't that important. Even if a hacker learns your salt, it's not that important. And if you have two different hashing algorithms, so the same salt combined with the same password has a different hash, it still doesn't help a hacker.

That said, the more sand or salt you can spray in a hackers face, the better. So if using different salts is no problem, use different salts.