Questions tagged [salt]
A salt is a random addition to a password to make the hashed password less susceptible to a lookup table attack
352
questions
0
votes
2answers
114 views
Does John the Ripper automatically account for salt and hash?
I have an embedded device running Armbian which I was able to get the drive image from. The entry in /etc/shadow combined with /etc/passwd after unshadowing is this:
root:$6$TV6ML2bG$TncnN/adtU9xaQs/...
2
votes
1answer
82 views
How can I use a unique salt for each user
I know there are various questions that seem similar, for instance, this one. However, it does not answer my question.
I'm creating a signup/login system (with node.js to be particular), and I'm ...
17
votes
1answer
5k views
How can Freeradius detect if the password provided is right when only the salted hash is stored in the database without the salt
I am discovering both Freeradius and the password hashing mechanism. I built a database (in MySQL) to store the passwords of some users. I have a user with the password in clear text, another one ...
3
votes
1answer
248 views
How can salted passwords work if you don't “keep the salts in the system”?
In this report on the recent ParkMobile breach, the article has this comment from the company:
“You are correct that bcrypt hashed and salted passwords were obtained,” Perkins said when asked about ...
1
vote
1answer
63 views
Is combining salt from two places secure enough and what length
I need to implement some hashing scheme for an open-source project. This is what I currently have and I'd like to hear whether this is secure enough -
The password is hashed using PBKDF2-SHA256 (which ...
0
votes
0answers
64 views
Is salt even secure once hacker has access to the database? [duplicate]
I have seen so many articles which they write that the salt is stored together with the hashed password in the database. However, there's one thing that is bugging me. Since the plain text salt is ...
0
votes
1answer
68 views
Sending and blocking emails from hashed and salted address ? (for GDPR)
I would like to send emails from a server, but also make them unable to trace for me as server owner or attackers. I want this for GDPR but also to protect people from abusers.
Short info about ...
8
votes
4answers
2k views
Alternatives for sending plaintext password while login
Note: I've already read Is it ok to send plain-text password over HTTPS? and https security - should password be hashed server-side or client-side?, but here it's about a specific replacement method (...
0
votes
3answers
121 views
Problem understanding salting
I'm a beginner in Information Security and am learning about salting. Unfortunately, most of the time I have to learn by myself since the lecturer doesn't provide deep explanation on these. I now have ...
0
votes
0answers
24 views
Time it will take to crack a password file? [duplicate]
I'm trying to answer a multiple-choice question which is the following:
"Consider the security of a password file, which includes a 10 bit
salt and all passwords are hashed, but known to consist ...
21
votes
3answers
4k views
Does complexity of salt in password hashing matter?
I have no cyber security knowledge whatsoever, and am trying to safely store passwords in a database. I understood I need to use salt, to avoid rainbow table attacks and to make sure two users with ...
2
votes
1answer
108 views
Password salting vs. length extension attacks
I read that when salting passwords, it is advised to use a h(pwd||salt) construction instead of h(salt||pwd), the latter being vulnerable to a length extension attack.
What are possible scenarios in ...
0
votes
0answers
50 views
Is my password database encryption flow secure?
I'm not an expert and I would be very glad if someone could take a look at it and tell if there are any problems with it
Here are the diagrams of getting/setting the password file from and to the ...
0
votes
2answers
103 views
Is adding encryption before hashing more secure?
One way to secure a password in the database is to hash it with salt i.e. appending a random string to the password and then hash it and store the value.
Does encrypting the password || salt then ...
0
votes
1answer
151 views
Modifying a SHA256 system to be ASIC resistant
I am looking for a way to protect a system utilizing SHA256 on semi-weak passwords against brute force attacks using ASIC-levels of hash-power, ideally by designing a system that is ASIC resistant.
...
0
votes
1answer
198 views
Encrypting salted password hash before storing in the database
I have read here and here, that instead of using pepper, it is better to encrypt hashed/salted passwords before storing in the database. Especially with Java, as there's no library for salt/pepper, ...
1
vote
1answer
167 views
Why are salted hashes better than just hashing? [duplicate]
I have recently read an article about storing passwords safely and I have a few misunderstandings. I found out 4 ways of storing users' passwords:
Just keep them in plain text
Keep passwords in plain ...
0
votes
1answer
467 views
Is it possible to reverse a sha256 hashed value if we know part of the input value?
I'm a total noob, so please help me out.
Suppose something is hashed in sha256. If we know the value of some part of the hashed text, can we figure out the entire text?
Ex: xxxxxx + j4l58jl6j4l6j4 = ...
1
vote
1answer
77 views
sql injection mitigation by signed db entries?
In a php/mysql based system I work on, they recently found several SQL injection vulnerabilities. Those come from 3rd party plugins, and I must assume there are more to be discovered.
My major concern ...
2
votes
1answer
425 views
Why people say that salt helps to prevent rainbow table attack? [duplicate]
I am using some frameworks that store salts inside databases. For example this article shows how Devise stores salt together with the user information. My question is why do people say that salts ...
1
vote
2answers
96 views
Is necessary to use salt if I use a complex password? [closed]
I read that it is important to use a salt together with the password to avoid rainbow table attack. I agree with that, but is there any difference, in terms of security, if
I use password + salt or
I ...
13
votes
3answers
6k views
How does a 'rainbow table' hacker obtain password hashes in the first place?
I don't understand this part of the Rainbow table attack.
In all my Google searches, it says that a hacker uses a rainbow table on password hashes.
But how does the hacker obtain the password hashes ...
9
votes
3answers
3k views
Client side password hashing with static salt - did I find a breach?
I downloaded a software that has a login interface. It's a $100 a month subscription software.
I disassembled the software and found that passwords are being sent by combining them with a hard coded &...
2
votes
0answers
146 views
What's the point of salting Double Submit Cookie (CSRF protection)?
Django web framework uses the Double Submit Cookie pattern for CSRF protection. (The CSRF token is sent in a cookie and also in a hidden form field. Incoming requests are checked for a match between ...
0
votes
1answer
193 views
Writing a Simple SHA256 Salted Hash Generator
I saw a video detailing how to write a simple salted hash program in C# here. Below is the code they wrote (slightly edited for console applications):
using System;
using System.Text;
using System....
2
votes
1answer
246 views
Oversalting Potentially Harmful?
I find it hard to believe, and figure I just missed or forgot something obvious (years since I thought about this stuff), so maybe someone can point it out. But it seems like most of what I know about ...
0
votes
1answer
113 views
Can a salt be a random ASCII string or be derived from one?
I'm using a KDF (PBKDF2HMAC) to generate a Fernet key from a given password, but to do so I also need to generate and store a salt.
import base64
import os
from cryptography.fernet import ...
0
votes
1answer
808 views
Can't solve format for Salted SHA1 hashes with Hashcat?
I am attempting to understand the format for this Salted SHA1 hash for an assignment. The line of text I was given was:
nameExample@email.com,nameExample,nameExample@email.com,nameExample,,,...
-1
votes
1answer
64 views
Using a Pepper as the index to insert a salt
In this question on this board the author of the selected answer states the following.
If you, as an attacker, manage to extract hashes and salts from a database, you probably either find a way to ...
7
votes
1answer
3k views
Which part of this encoded Argon2 hash is the salt?
I was reading the post Is it safe/wise to store a salt in the same field as the hashed password?:
$argon2i$v=19$m=65536,t=3,p=1$YOtX2//7NoD/owm8RZ8llw==$fPn4sPgkFAuBJo3M3UzcGss3dJysxLJdPdvojRF20ZE=
...
1
vote
3answers
116 views
Using two salts - one stored with the password, one stored in a random row in a separate table
Imagine a login system is being created, and a user's password is hashed thusly:
Users.password = PBKDF2(salt1 + password + salt2)
The result of that ^ operation and salt1 are stored side-by-side in ...
30
votes
9answers
7k views
Is there a way to add salted hashing to my user authentication without breaking my former login server
I am presented with the following scenario:
I have a MySQL-Database with a table of users. The table has two fields: username and password. The password is stored as an unsalted hash.
An over 15 ...
0
votes
1answer
97 views
should giving salt to unauthenticated users be a problem
Let's say i have a scenario when the user salt is required in client side before login,
the user obtains the salt by this url http://my-api.example/get-salt/userid
that url should return a salt for ...
1
vote
1answer
126 views
Password hashing with salt. Where do you leave the salt? [duplicate]
I want to hash a set of sensitive data using a hash+salt. I've done a little research and now I know that:
The salt should be random.
The salt should not be reused.
Using hashing without salt makes ...
0
votes
1answer
161 views
How should we apply the salt to the password? [duplicate]
According to Wikipedia:
A rainbow table is ineffective against one-way hashes that include large salts. For example, consider a password hash that is generated using the following function (where "|...
2
votes
2answers
143 views
Am I using RfcDeriveBytes correctly, when the salt I'm providing it contains the password?
I'm using Rfc2898DeriveBytes in my application to encrypt a password with a randomly generated salt, and with a set iterator count for slowness.
Before, I just grabbed the generated salt and put it ...
2
votes
3answers
951 views
Anonymizing IP addresses using (sha) hashes; how to circumvent rainbow table attacks?
Under GDPR, IP addresses are personal data. I have no need to trace back IP to specific users, but I would like to limit downloads to one per IP.* I do not want to store plain IPs.
My first solution ...
22
votes
8answers
6k views
How can I re-use my password and still protect the password if it is exposed from one source?
I know that all servers should at least store my credentials as hash(password + salt) + salt, with a secure and well known hash function and a salt unique for me, generated from a secure and well ...
2
votes
1answer
166 views
is it safe to AES encrypt the RSA private key and storing it in the database
i'm building an app that really needs encryption of this type , my question is it safe to store the aes encrypted RSA key in the database ?
here is how i encrypt the key :
i generate a random 256 ...
0
votes
1answer
177 views
How to identify the right hash from a list of salts and pre-given password during authentication?
I apologize for being naive, but I only recently started learning about cryptography and how to go about the security online.
From what I've gathered, the safest-without-sacrificing-efficiency way ...
0
votes
0answers
385 views
How long will it take to crack a hashed random string
If I generate 128 bit, 512 bit and 1024 bit random strings using either:
A native rand() function (C, PHP, Python, etc)
OpenSSL random bytes
Hardware generated random number
And hash the random ...
0
votes
3answers
74 views
How to make the first request which used to create account safe? [duplicate]
To authorize user, our application defined below steps:
Send user email and password (plain text) through HTTPS.
When server received it, generate a salt to hash password and store it.
When user ...
1
vote
2answers
211 views
Letting client encrypt his/her data. How to ensure the client doesn't lose his/her private data?
I am designing a web service where the client is allowed to encrypt his own data on client-side software & then send it to our server, so they can be sure their data is private on our side. Then, ...
5
votes
1answer
1k views
Do I need to use salt with api key hashing?
I will generate api keys. I plan to store their hashes instead of plain text. do i also need salt, similar to storing password?
AFAIK salt prevents rainbow table attack and those are more ...
0
votes
1answer
72 views
Password storage which avoids privileged insider attack
What are the standard password authentication protocols in client-server setting where authentication happens at the remote server? Is there any password/pin verification protocol which reveals zero ...
2
votes
1answer
612 views
Is hashing without a salt secure for random passwords? [duplicate]
I'm designing an API with token authentication.
I don't want to store tokens as plain text in the database, for the same reason user passwords are not stored as plain text: if the database gets ...
0
votes
0answers
29 views
Is a combination of user login and site domain a sensible salt? [duplicate]
Just out of curiosity (since I know the established password hashing libraries should provide "proper" random salts), would a combination of the user login and the respective site's domain (or a hash ...
0
votes
1answer
49 views
Secure Register - Login Portal [closed]
Im trying to create a secure portal for parents to view their sons or daughters information.
I would need to have a register page. Im having trouble with hashing and salting the password.
Then I ...
4
votes
2answers
2k views
Appending a secret (pepper) to Argon2 password hashes
I've read quite a bit of the StackExchange and HackerNews debates on the user of "peppers" in password hash security. There are a number of different implementations of the idea of a pepper, ranging ...
1
vote
3answers
442 views
Hash pepper in web application possible?
I have read a few articles and several question on here about hashing correctly.
While hashing, adding salt and especially pepper is primarily a server side use case, I am interested in the ...
