Questions tagged [salt]

A salt is a random addition to a password to make the hashed password less susceptible to a lookup table attack

Filter by
Sorted by
Tagged with
1 vote
1 answer
86 views

Is it secure to expose a salted bcrypt hash IF it is maximum length random secure password?

Is it secure to expose a salted bcrypt hash (minimum 14 cost) if the used password is 72 characters (maximum) byte long, randomly generated letters, numbers, and special characters using secure ...
  • 13
15 votes
1 answer
4k views

Is it a good practice to add hard-coded salt to BCrypt passwords?

I am currently learning about cybersecurity and trying to implement it in my next web application. I have been reading some articles about hashing, specifically SHA2 and Blowfish. In this article, it ...
1 vote
0 answers
16 views

Can parts of WebCrypto AES-GCM be reused between encryptions

I am trying to better understand the processes involved in e2ee using WebCrypto on the browser. I understand that the only real method to use a passphrase to generate a symmetric key on the browser is ...
  • 111
1 vote
2 answers
121 views

Using hash to search encrypted records

If I am using SHA-512 hash values merely as a means to search fields that have been encrypted elsewhere, is it cryptographically secure enough to hash without salt? For background, I have been given a ...
0 votes
1 answer
73 views

Why GNU libc's salt alphabet for `crypt` is limited to ./0-9A-Za-z?

According to docs: To hash a new passphrase for storage, set salt to a string consisting of [a prefix plus] a sequence of randomly chosen characters ... and In all cases, the random characters ...
  • 103
1 vote
1 answer
65 views

Does recalculating per-user salt every time a user changes password make any difference?

I have set it up so that when my users change their password, the salt is recomputed. Besides hiding the fact that they may change their password to the same thing (I am checking that by first hashing ...
  • 133
0 votes
0 answers
36 views

What are the underlying mechanics that make password salting an effective deterrent against Rainbow Tables? [duplicate]

I have a top level familiarity with Rainbow tables (1 ,2 ) I also understand that salting adds a randomly generated alphanumeric string to each password before it gets hashed and put in a database. My ...
3 votes
1 answer
152 views

Does this theoretical salted-hash-sleep scheme mitigate timing attacks?

This question is purely theoretical, I have no intention of ever implementing this scheme in practice. I'm familiar with the shortcomings of sleeping as means of mitigating timing attacks. I'm more ...
4 votes
1 answer
149 views

Hashing to protect privacy

I like to know if hashing protects privacy enough, i.e., if a hash of PII is still considered to be personally identifying information (PII). I found this article: https://www.johndcook.com/blog/2019/...
  • 41
0 votes
2 answers
101 views

Design for deleting users accounts, yet knowing when they register again

My webapp takes in email addresses as user names at registration, verifies ownership by sending emails with confirmation links, etc. I'm now looking for a secure design of a user deletion feature, ...
1 vote
1 answer
308 views

HMAC SHA256 by using a static key + text as a key

Maybe it's not a good idea, but I would like to check it with you. When using HMAC SHA to hash a clear text value (string max 30 char) I need to use a key (256) but in my scenario this key is static ...
0 votes
2 answers
258 views

How different ldap implementations are generating random salt?

I am currently generating a salted SHA 256 passwords in the below format $hash = "{SHA256}".base64_encode(hash('sha256', $password . $salt) . $salt) . Using the below libraries of Java ...
2 votes
3 answers
2k views

How can I extract salt from encoded base64 Salted SHA 256 hashed password

I have a SSHA256 hashed password. Below is the plaintext and hashed password for it. PlainText -p@ssw0rd Encrypted -{SSHA256}LGkJJV6e7wPDKEr3BKSg0K0XDllewz9tvSNSaslDmIfPFmyuI5blUK/...
0 votes
1 answer
150 views

Find pre-images of hashed email addresses

This is a cryptographic challenge I was given: I have a list of 1000 hashed email addresses where I know the domain name for them (eg. "@gmail.com"). According to hashes.com: Possible ...
0 votes
2 answers
91 views

When using a user password for client side encryption, do I have to store the salt for the user encryption key on the server?

The password of the user shall be used for client side encryption. A PBKDF and salt shall be used to derive a key from the user password. Do I need to store this salt on the server and deliver it to ...
  • 707
2 votes
3 answers
248 views

Is using random salt to pbkdf2 for every request to Rest API good/bad?

Here are my conditions: My Rest API must accept username and plain password. But, that's very bad. That's why the client must encrypt the password first and my rest API will decrypt it to get the ...
1 vote
0 answers
141 views

Choosing the right salt to pseudo-anonymize data and be GDPR compliant

In my company, numeric user IDs are considered PIIs and therefore need to be pseudo-anonymized to be GDPR compliant. To do so, we populate a lookup table where to each ID is assigned a monotonically ...
  • 111
0 votes
1 answer
377 views

Is pbkdf2 with hmac using md5 still secure?

I have an old system that can do PBKDF2 with HMAC using MD5, but not SHA-2. Now I know that MD5 is insecure and shouldn't be used for new applications, but https://crypto.stackexchange.com/a/9340/...
  • 1,146
0 votes
2 answers
3k views

Does John the Ripper automatically account for salt and hash?

I have an embedded device running Armbian which I was able to get the drive image from. The entry in /etc/shadow combined with /etc/passwd after unshadowing is this: root:$6$TV6ML2bG$TncnN/adtU9xaQs/...
2 votes
1 answer
331 views

How can I use a unique salt for each user

I know there are various questions that seem similar, for instance, this one. However, it does not answer my question. I'm creating a signup/login system (with node.js to be particular), and I'm ...
  • 23
17 votes
1 answer
6k views

How can Freeradius detect if the password provided is right when only the salted hash is stored in the database without the salt

I am discovering both Freeradius and the password hashing mechanism. I built a database (in MySQL) to store the passwords of some users. I have a user with the password in clear text, another one ...
  • 173
3 votes
1 answer
313 views

How can salted passwords work if you don't "keep the salts in the system"?

In this report on the recent ParkMobile breach, the article has this comment from the company: “You are correct that bcrypt hashed and salted passwords were obtained,” Perkins said when asked about ...
1 vote
1 answer
116 views

Is combining salt from two places secure enough and what length

I need to implement some hashing scheme for an open-source project. This is what I currently have and I'd like to hear whether this is secure enough - The password is hashed using PBKDF2-SHA256 (which ...
  • 113
0 votes
0 answers
64 views

Is salt even secure once hacker has access to the database? [duplicate]

I have seen so many articles which they write that the salt is stored together with the hashed password in the database. However, there's one thing that is bugging me. Since the plain text salt is ...
  • 9
0 votes
1 answer
198 views

Sending and blocking emails from hashed and salted address ? (for GDPR)

I would like to send emails from a server, but also make them unable to trace for me as server owner or attackers. I want this for GDPR but also to protect people from abusers. Short info about ...
user avatar
10 votes
4 answers
3k views

Alternatives for sending plaintext password while login

Note: I've already read Is it ok to send plain-text password over HTTPS? and https security - should password be hashed server-side or client-side?, but here it's about a specific replacement method (...
  • 951
0 votes
3 answers
177 views

Problem understanding salting

I'm a beginner in Information Security and am learning about salting. Unfortunately, most of the time I have to learn by myself since the lecturer doesn't provide deep explanation on these. I now have ...
0 votes
0 answers
89 views

Time it will take to crack a password file? [duplicate]

I'm trying to answer a multiple-choice question which is the following: "Consider the security of a password file, which includes a 10 bit salt and all passwords are hashed, but known to consist ...
21 votes
3 answers
4k views

Does complexity of salt in password hashing matter?

I have no cyber security knowledge whatsoever, and am trying to safely store passwords in a database. I understood I need to use salt, to avoid rainbow table attacks and to make sure two users with ...
2 votes
1 answer
226 views

Password salting vs. length extension attacks

I read that when salting passwords, it is advised to use a h(pwd||salt) construction instead of h(salt||pwd), the latter being vulnerable to a length extension attack. What are possible scenarios in ...
0 votes
2 answers
182 views

Is adding encryption before hashing more secure?

One way to secure a password in the database is to hash it with salt i.e. appending a random string to the password and then hash it and store the value. Does encrypting the password || salt then ...
  • 137
0 votes
1 answer
296 views

Modifying a SHA256 system to be ASIC resistant

I am looking for a way to protect a system utilizing SHA256 on semi-weak passwords against brute force attacks using ASIC-levels of hash-power, ideally by designing a system that is ASIC resistant. ...
0 votes
1 answer
482 views

Encrypting salted password hash before storing in the database

I have read here and here, that instead of using pepper, it is better to encrypt hashed/salted passwords before storing in the database. Especially with Java, as there's no library for salt/pepper, ...
  • 105
1 vote
1 answer
274 views

Why are salted hashes better than just hashing? [duplicate]

I have recently read an article about storing passwords safely and I have a few misunderstandings. I found out 4 ways of storing users' passwords: Just keep them in plain text Keep passwords in plain ...
  • 13
2 votes
1 answer
3k views

Is it possible to reverse a sha256 hashed value if we know part of the input value?

I'm a total noob, so please help me out. Suppose something is hashed in sha256. If we know the value of some part of the hashed text, can we figure out the entire text? Ex: xxxxxx + j4l58jl6j4l6j4 = ...
1 vote
1 answer
129 views

sql injection mitigation by signed db entries?

In a php/mysql based system I work on, they recently found several SQL injection vulnerabilities. Those come from 3rd party plugins, and I must assume there are more to be discovered. My major concern ...
3 votes
1 answer
842 views

Why people say that salt helps to prevent rainbow table attack? [duplicate]

I am using some frameworks that store salts inside databases. For example this article shows how Devise stores salt together with the user information. My question is why do people say that salts ...
  • 465
1 vote
2 answers
176 views

Is necessary to use salt if I use a complex password? [closed]

I read that it is important to use a salt together with the password to avoid rainbow table attack. I agree with that, but is there any difference, in terms of security, if I use password + salt or I ...
  • 465
13 votes
3 answers
6k views

How does a 'rainbow table' hacker obtain password hashes in the first place?

I don't understand this part of the Rainbow table attack. In all my Google searches, it says that a hacker uses a rainbow table on password hashes. But how does the hacker obtain the password hashes ...
10 votes
3 answers
3k views

Client side password hashing with static salt - did I find a breach?

I downloaded a software that has a login interface. It's a $100 a month subscription software. I disassembled the software and found that passwords are being sent by combining them with a hard coded &...
  • 203
2 votes
0 answers
459 views

What's the point of salting Double Submit Cookie (CSRF protection)?

Django web framework uses the Double Submit Cookie pattern for CSRF protection. (The CSRF token is sent in a cookie and also in a hidden form field. Incoming requests are checked for a match between ...
  • 131
0 votes
1 answer
1k views

Writing a Simple SHA256 Salted Hash Generator

I saw a video detailing how to write a simple salted hash program in C# here. Below is the code they wrote (slightly edited for console applications): using System; using System.Text; using System....
2 votes
1 answer
304 views

Oversalting Potentially Harmful?

I find it hard to believe, and figure I just missed or forgot something obvious (years since I thought about this stuff), so maybe someone can point it out. But it seems like most of what I know about ...
  • 379
0 votes
1 answer
208 views

Can a salt be a random ASCII string or be derived from one?

I'm using a KDF (PBKDF2HMAC) to generate a Fernet key from a given password, but to do so I also need to generate and store a salt. import base64 import os from cryptography.fernet import ...
  • 135
0 votes
1 answer
1k views

Can't solve format for Salted SHA1 hashes with Hashcat?

I am attempting to understand the format for this Salted SHA1 hash for an assignment. The line of text I was given was: nameExample@email.com,nameExample,nameExample@email.com,nameExample,,,...
-1 votes
1 answer
104 views

Using a Pepper as the index to insert a salt

In this question on this board the author of the selected answer states the following. If you, as an attacker, manage to extract hashes and salts from a database, you probably either find a way to ...
6 votes
1 answer
7k views

Which part of this encoded Argon2 hash is the salt?

I was reading the post Is it safe/wise to store a salt in the same field as the hashed password?: $argon2i$v=19$m=65536,t=3,p=1$YOtX2//7NoD/owm8RZ8llw==$fPn4sPgkFAuBJo3M3UzcGss3dJysxLJdPdvojRF20ZE= ...
1 vote
3 answers
156 views

Using two salts - one stored with the password, one stored in a random row in a separate table

Imagine a login system is being created, and a user's password is hashed thusly: Users.password = PBKDF2(salt1 + password + salt2) The result of that ^ operation and salt1 are stored side-by-side in ...
  • 13
30 votes
9 answers
8k views

Is there a way to add salted hashing to my user authentication without breaking my former login server

I am presented with the following scenario: I have a MySQL-Database with a table of users. The table has two fields: username and password. The password is stored as an unsalted hash. An over 15 ...
  • 403
0 votes
1 answer
138 views

should giving salt to unauthenticated users be a problem

Let's say i have a scenario when the user salt is required in client side before login, the user obtains the salt by this url http://my-api.example/get-salt/userid that url should return a salt for ...
user avatar

1
2 3 4 5
8