Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [salt]

A salt is a random addition to a password to make the hashed password less susceptible to a lookup table attack

Filter by
Sorted by
Tagged with
0 votes
1 answer
37 views

Hash security and penetration testing [closed]

I've been looking at hash security, and how tools like hashcat and John The Ripper work. I seem to have misunderstood some basic stuff, and would appreciate some clarification on: If you're pen ...
QF0's user avatar
  • 101
0 votes
1 answer
75 views

Crack hash with given salt and dictionary [duplicate]

pbkdf2:sha256:600000$m28HtZYwJYMjkhJ5$2d481c9f3fe597390e4c4192f762188bf311e834030a11e069019015fb336c14 This is the format in which I have the hash. I also have a dictionary which consists of the ...
Ankeet Saha's user avatar
0 votes
1 answer
37 views

How to verify the salt in the SCRAM protocol?

I've recently read about the SCRAM authentication protocol. One of the stated design motivations is to support mutual authentication, but how does the client verify that the salt and cost parameters ...
n-l-i's user avatar
  • 326
0 votes
1 answer
51 views

Question about storing salt values and hashed passwords in the database [duplicate]

So I was reading through an article about how passwords are salted and hashed through a cryptographic function here, and found out that hashed passwords, along with the plaintext salt values are ...
mantot123's user avatar
0 votes
2 answers
171 views

How bad would a Hash algorithm leak would be?

Context: When the Twitch whole code repository was leaked, it created multiple discussions on social medias. And one day I was on Reddit and said that the leak of the hashing algorithm and the salt ...
CARLOS EDUARDO NISHI's user avatar
0 votes
4 answers
2k views

Can somebody explain simply why crypt of a password with a salt (the hash result) is equal to crypt of the password with the hash result itself?

Can somebody explain simply why crypt of a password with a salt (the hash result) is equal to crypt of the password with the hash result itself ? Surely there is a simple mathematical explanation. I ...
Winston L's user avatar
0 votes
0 answers
134 views

What to do if i have no salt?

Here is my situation : we've got ID, named TIP, from remote and large databases. We want to store all the data, but laws prevents us to store the TIP directly, but rather anonymize them, for security ...
aluriak's user avatar
  • 133
1 vote
1 answer
307 views

Two different salted hashes of the same password for the same user

I am creating an authentication system that is able to login to the same account with different sets of credentials. I also want to allow users to login with either username or email with the same ...
the Radek's user avatar
1 vote
1 answer
495 views

What is the effect of salt and no. of rounds in mkpasswd encryption?

I'm currently trying to understand how salting and no. of rounds work using mkpasswd. These are the commands that I have been experimenting around. cp@cp-vm:~/Asg2_Task1b$ time mkpasswd -m sha-512 ...
Chloe's user avatar
  • 11
2 votes
1 answer
2k views

Crack with Hashcat using hash and salt

I am new to Hashcat and I am trying to crack a password/salt hash. Everything I have tried comes back as "no hash-mode matches..." Any assistance on the correct hashcat command line would ...
Sara Witherow's user avatar
1 vote
0 answers
34 views

How should an argon2 hash be stored? [duplicate]

Given the following argon2 hash $argon2id$v=19$m=65536,t=32,p=8$mJmKA5qamzXOPJZYw4wCEUKY$COkMH0RckaZ/3bhYCdCQjLuzoLKxcAmk4TzmHRRgTQ8 How should the hash be stored in a database? From the answers of ...
Zack.B_'s user avatar
  • 11
0 votes
1 answer
269 views

Storing two hashes of same password?

Typically for user passwords we store their hashes and salt alongside in the database - one per user. I wonder the security implications of hashing the same password twice and storing locally both. ...
Johan Hanssen Seferidis's user avatar
3 votes
4 answers
2k views

Using a Client and Server secret to double salt a hash

I want to log IP addresses visiting my site, for aggregated statistics only and to see if the same IP address has visited twice. But I don't want to expose them. My Idea is in my database. $...
Greedo's user avatar
  • 131
1 vote
1 answer
244 views

Is it secure to expose a salted bcrypt hash IF it is maximum length random secure password?

Is it secure to expose a salted bcrypt hash (minimum 14 cost) if the used password is 72 characters (maximum) byte long, randomly generated letters, numbers, and special characters using secure ...
DonEr's user avatar
  • 13
15 votes
1 answer
5k views

Is it a good practice to add hard-coded salt to BCrypt passwords?

I am currently learning about cybersecurity and trying to implement it in my next web application. I have been reading some articles about hashing, specifically SHA2 and Blowfish. In this article, it ...
Josep Enric Sendra Serra's user avatar
1 vote
0 answers
66 views

Can parts of WebCrypto AES-GCM be reused between encryptions

I am trying to better understand the processes involved in e2ee using WebCrypto on the browser. I understand that the only real method to use a passphrase to generate a symmetric key on the browser is ...
masimplo's user avatar
  • 111
2 votes
2 answers
512 views

Using hash to search encrypted records

If I am using SHA-512 hash values merely as a means to search fields that have been encrypted elsewhere, is it cryptographically secure enough to hash without salt? For background, I have been given a ...
Arlo Guthrie's user avatar
0 votes
1 answer
128 views

Why GNU libc's salt alphabet for `crypt` is limited to ./0-9A-Za-z?

According to docs: To hash a new passphrase for storage, set salt to a string consisting of [a prefix plus] a sequence of randomly chosen characters ... and In all cases, the random characters ...
Anthony's user avatar
  • 103
1 vote
1 answer
166 views

Does recalculating per-user salt every time a user changes password make any difference?

I have set it up so that when my users change their password, the salt is recomputed. Besides hiding the fact that they may change their password to the same thing (I am checking that by first hashing ...
JoSSte's user avatar
  • 149
0 votes
0 answers
77 views

What are the underlying mechanics that make password salting an effective deterrent against Rainbow Tables? [duplicate]

I have a top level familiarity with Rainbow tables (1 ,2 ) I also understand that salting adds a randomly generated alphanumeric string to each password before it gets hashed and put in a database. My ...
user277528's user avatar
3 votes
1 answer
210 views

Does this theoretical salted-hash-sleep scheme mitigate timing attacks?

This question is purely theoretical, I have no intention of ever implementing this scheme in practice. I'm familiar with the shortcomings of sleeping as means of mitigating timing attacks. I'm more ...
PhilipRoman's user avatar
4 votes
1 answer
899 views

Hashing to protect privacy

I like to know if hashing protects privacy enough, i.e., if a hash of PII is still considered to be personally identifying information (PII). I found this article: https://www.johndcook.com/blog/2019/...
Bart's user avatar
  • 51
1 vote
2 answers
241 views

Design for deleting users accounts, yet knowing when they register again

My webapp takes in email addresses as user names at registration, verifies ownership by sending emails with confirmation links, etc. I'm now looking for a secure design of a user deletion feature, ...
Jan Żankowski's user avatar
1 vote
1 answer
2k views

HMAC SHA256 by using a static key + text as a key

Maybe it's not a good idea, but I would like to check it with you. When using HMAC SHA to hash a clear text value (string max 30 char) I need to use a key (256) but in my scenario this key is static ...
Marc Alves's user avatar
0 votes
2 answers
501 views

How different ldap implementations are generating random salt?

I am currently generating a salted SHA 256 passwords in the below format $hash = "{SHA256}".base64_encode(hash('sha256', $password . $salt) . $salt) . Using the below libraries of Java ...
Karan Nayyar's user avatar
2 votes
3 answers
7k views

How can I extract salt from encoded base64 Salted SHA 256 hashed password

I have a SSHA256 hashed password. Below is the plaintext and hashed password for it. PlainText -p@ssw0rd Encrypted -{SSHA256}LGkJJV6e7wPDKEr3BKSg0K0XDllewz9tvSNSaslDmIfPFmyuI5blUK/...
Karan Nayyar's user avatar
0 votes
1 answer
324 views

Find pre-images of hashed email addresses

This is a cryptographic challenge I was given: I have a list of 1000 hashed email addresses where I know the domain name for them (eg. "@gmail.com"). According to hashes.com: Possible ...
rookie133t's user avatar
0 votes
2 answers
166 views

When using a user password for client side encryption, do I have to store the salt for the user encryption key on the server?

The password of the user shall be used for client side encryption. A PBKDF and salt shall be used to derive a key from the user password. Do I need to store this salt on the server and deliver it to ...
Gamer2015's user avatar
  • 727
2 votes
3 answers
665 views

Is using random salt to pbkdf2 for every request to Rest API good/bad?

Here are my conditions: My Rest API must accept username and plain password. But, that's very bad. That's why the client must encrypt the password first and my rest API will decrypt it to get the ...
fahadh4ilyas's user avatar
1 vote
1 answer
340 views

Choosing the right salt to pseudo-anonymize data and be GDPR compliant

In my company, numeric user IDs are considered PIIs and therefore need to be pseudo-anonymized to be GDPR compliant. To do so, we populate a lookup table where to each ID is assigned a monotonically ...
Vektor88's user avatar
  • 111
0 votes
1 answer
816 views

Is pbkdf2 with hmac using md5 still secure?

I have an old system that can do PBKDF2 with HMAC using MD5, but not SHA-2. Now I know that MD5 is insecure and shouldn't be used for new applications, but https://crypto.stackexchange.com/a/9340/...
Brian Minton's user avatar
  • 1,226
0 votes
2 answers
8k views

Does John the Ripper automatically account for salt and hash?

I have an embedded device running Armbian which I was able to get the drive image from. The entry in /etc/shadow combined with /etc/passwd after unshadowing is this: root:$6$TV6ML2bG$TncnN/adtU9xaQs/...
Nubtastic's user avatar
2 votes
1 answer
645 views

How can I use a unique salt for each user

I know there are various questions that seem similar, for instance, this one. However, it does not answer my question. I'm creating a signup/login system (with node.js to be particular), and I'm ...
ublec's user avatar
  • 23
17 votes
1 answer
7k views

How can Freeradius detect if the password provided is right when only the salted hash is stored in the database without the salt

I am discovering both Freeradius and the password hashing mechanism. I built a database (in MySQL) to store the passwords of some users. I have a user with the password in clear text, another one ...
molik's user avatar
  • 173
3 votes
1 answer
361 views

How can salted passwords work if you don't "keep the salts in the system"?

In this report on the recent ParkMobile breach, the article has this comment from the company: “You are correct that bcrypt hashed and salted passwords were obtained,” Perkins said when asked about ...
Joshua Frank's user avatar
1 vote
1 answer
222 views

Is combining salt from two places secure enough and what length

I need to implement some hashing scheme for an open-source project. This is what I currently have and I'd like to hear whether this is secure enough - The password is hashed using PBKDF2-SHA256 (which ...
Dan's user avatar
  • 113
0 votes
0 answers
64 views

Is salt even secure once hacker has access to the database? [duplicate]

I have seen so many articles which they write that the salt is stored together with the hashed password in the database. However, there's one thing that is bugging me. Since the plain text salt is ...
Newbie's user avatar
  • 9
0 votes
1 answer
309 views

Sending and blocking emails from hashed and salted address ? (for GDPR)

I would like to send emails from a server, but also make them unable to trace for me as server owner or attackers. I want this for GDPR but also to protect people from abusers. Short info about ...
user avatar
11 votes
4 answers
5k views

Alternatives for sending plaintext password while login

Note: I've already read Is it ok to send plain-text password over HTTPS? and https security - should password be hashed server-side or client-side?, but here it's about a specific replacement method (...
Basj's user avatar
  • 953
0 votes
3 answers
212 views

Problem understanding salting

I'm a beginner in Information Security and am learning about salting. Unfortunately, most of the time I have to learn by myself since the lecturer doesn't provide deep explanation on these. I now have ...
Margaret Nguyen's user avatar
0 votes
0 answers
128 views

Time it will take to crack a password file? [duplicate]

I'm trying to answer a multiple-choice question which is the following: "Consider the security of a password file, which includes a 10 bit salt and all passwords are hashed, but known to consist ...
LoSpazzino's user avatar
20 votes
3 answers
4k views

Does complexity of salt in password hashing matter?

I have no cyber security knowledge whatsoever, and am trying to safely store passwords in a database. I understood I need to use salt, to avoid rainbow table attacks and to make sure two users with ...
N1ark's user avatar
  • 303
2 votes
1 answer
325 views

Password salting vs. length extension attacks

I read that when salting passwords, it is advised to use a h(pwd||salt) construction instead of h(salt||pwd), the latter being vulnerable to a length extension attack. What are possible scenarios in ...
Gregory45's user avatar
0 votes
2 answers
224 views

Is adding encryption before hashing more secure?

One way to secure a password in the database is to hash it with salt i.e. appending a random string to the password and then hash it and store the value. Does encrypting the password || salt then ...
xcoder's user avatar
  • 137
0 votes
1 answer
453 views

Modifying a SHA256 system to be ASIC resistant

I am looking for a way to protect a system utilizing SHA256 on semi-weak passwords against brute force attacks using ASIC-levels of hash-power, ideally by designing a system that is ASIC resistant. ...
Albert Renshaw's user avatar
0 votes
1 answer
914 views

Encrypting salted password hash before storing in the database

I have read here and here, that instead of using pepper, it is better to encrypt hashed/salted passwords before storing in the database. Especially with Java, as there's no library for salt/pepper, ...
BUKTOP's user avatar
  • 105
1 vote
1 answer
346 views

Why are salted hashes better than just hashing? [duplicate]

I have recently read an article about storing passwords safely and I have a few misunderstandings. I found out 4 ways of storing users' passwords: Just keep them in plain text Keep passwords in plain ...
ALEX's user avatar
  • 13
3 votes
1 answer
7k views

Is it possible to reverse a sha256 hashed value if we know part of the input value?

I'm a total noob, so please help me out. Suppose something is hashed in sha256. If we know the value of some part of the hashed text, can we figure out the entire text? Ex: xxxxxx + j4l58jl6j4l6j4 = ...
Ananda Sai A's user avatar
1 vote
1 answer
159 views

sql injection mitigation by signed db entries?

In a php/mysql based system I work on, they recently found several SQL injection vulnerabilities. Those come from 3rd party plugins, and I must assume there are more to be discovered. My major concern ...
Zsolt Szilagy's user avatar
3 votes
1 answer
1k views

Why people say that salt helps to prevent rainbow table attack? [duplicate]

I am using some frameworks that store salts inside databases. For example this article shows how Devise stores salt together with the user information. My question is why do people say that salts ...
juaninf's user avatar
  • 465

1
2 3 4 5
8