This question already has an answer here:

Salts are stored in the plain text and readily available with the hashed passwords if the password database is compromised. What if we encrypt the salt using password itself? Doesn't it make offline dictionary attack more difficult as the attacker now has to identify the salt to break the password and break the password to identify the salt?

With this scheme, password is hashed with a random salt and random salt is not stored in plain but encrypted with the password.

marked as duplicate by Mark, AviD Sep 16 '14 at 7:51

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.


A common attack is to check hashes against common passwords. In that case your solution would add only one more round of decryption:

  1. choose a common password (for example "password123")
  2. decrypt the salt with the chosen password
  3. hash the chosen password with the decrypted salt

Therefore you're only making attacks slower and introduce more complexity to your solution. I would use a higher cost parameter for your hashing algorithm.

  • Please correct me if I am wrong. The proposed scheme basically adds just 1 more step for the attacker, the step being of decryption of the salt. Even if the password is random and therefore not common, then the brute force search attack will try every candidate password first to decrypt the salt and then hash the same candidate password with the decrypted salt. – Curious Sep 16 '14 at 7:26
  • @Curious just use a good hashing algorithm like scrypt, bcrypt or pbkdf2 and increase the cost in a way provided by that hashing algorithm instead of rolling your own. Salts are meant to be unique, not to be secret. Don't start misusing them to increase the cost. – Darsstar Sep 16 '14 at 7:47
  • @Curious, there's no way for the attacker to know that he successfully decrypted the salt. Hence, a brute force attack will follow the steps outlined in the answer. First the attacker will choose a random password, and then decrypt the salt and then hash the password with the decrypted salt. You're not actually adding any security by encrypting the salt. – Chris Murray Sep 16 '14 at 7:49
  • @Curious: Correct. A random password would just decrease the chance for match, so it's unlikely that an attacker would try random passwords. – Christian Strempfer Sep 16 '14 at 7:51
  • @Chris Murray, hashing the decrypted salt with the guessed password can be verified against the hash of a password in the database. So attacker will know that he has successfully decrypted the salt. Successful decryption of salt implies successful guessing the password. Isn't it? – Curious Sep 16 '14 at 8:41

Not the answer you're looking for? Browse other questions tagged or ask your own question.