Questions tagged [salt]
A salt is a random addition to a password to make the hashed password less susceptible to a lookup table attack
368
questions
1
vote
1
answer
86
views
Is it secure to expose a salted bcrypt hash IF it is maximum length random secure password?
Is it secure to expose a salted bcrypt hash (minimum 14 cost) if the used password is 72 characters (maximum) byte long, randomly generated letters, numbers, and special characters using secure ...
- 13
15
votes
1
answer
4k
views
Is it a good practice to add hard-coded salt to BCrypt passwords?
I am currently learning about cybersecurity and trying to implement it in my next web application.
I have been reading some articles about hashing, specifically SHA2 and Blowfish.
In this article, it ...
1
vote
0
answers
16
views
Can parts of WebCrypto AES-GCM be reused between encryptions
I am trying to better understand the processes involved in e2ee using WebCrypto on the browser.
I understand that the only real method to use a passphrase to generate a symmetric key on the browser is ...
- 111
1
vote
2
answers
121
views
Using hash to search encrypted records
If I am using SHA-512 hash values merely as a means to search fields that have been encrypted elsewhere, is it cryptographically secure enough to hash without salt?
For background, I have been given a ...
- 111
0
votes
1
answer
73
views
Why GNU libc's salt alphabet for `crypt` is limited to ./0-9A-Za-z?
According to docs:
To hash a new passphrase for storage, set salt to a string consisting of [a prefix plus] a sequence of randomly chosen characters ...
and
In all cases, the random characters ...
- 103
1
vote
1
answer
65
views
Does recalculating per-user salt every time a user changes password make any difference?
I have set it up so that when my users change their password, the salt is recomputed.
Besides hiding the fact that they may change their password to the same thing (I am checking that by first hashing ...
- 133
0
votes
0
answers
36
views
What are the underlying mechanics that make password salting an effective deterrent against Rainbow Tables? [duplicate]
I have a top level familiarity with Rainbow tables (1 ,2 )
I also understand that salting adds a randomly generated alphanumeric string to each password before it gets hashed and put in a database.
My ...
3
votes
1
answer
152
views
Does this theoretical salted-hash-sleep scheme mitigate timing attacks?
This question is purely theoretical, I have no intention of ever implementing this scheme in practice. I'm familiar with the shortcomings of sleeping as means of mitigating timing attacks. I'm more ...
- 133
4
votes
1
answer
149
views
Hashing to protect privacy
I like to know if hashing protects privacy enough, i.e., if a hash of PII is still considered to be personally identifying information (PII).
I found this article: https://www.johndcook.com/blog/2019/...
- 41
0
votes
2
answers
101
views
Design for deleting users accounts, yet knowing when they register again
My webapp takes in email addresses as user names at registration, verifies ownership by sending emails with confirmation links, etc.
I'm now looking for a secure design of a user deletion feature, ...
- 353
1
vote
1
answer
308
views
HMAC SHA256 by using a static key + text as a key
Maybe it's not a good idea, but I would like to check it with you.
When using HMAC SHA to hash a clear text value (string max 30 char) I need to use a key (256) but in my scenario this key is static ...
- 59
0
votes
2
answers
258
views
How different ldap implementations are generating random salt?
I am currently generating a salted SHA 256 passwords in the below format
$hash = "{SHA256}".base64_encode(hash('sha256', $password . $salt) . $salt) .
Using the below libraries of Java ...
- 125
2
votes
3
answers
2k
views
How can I extract salt from encoded base64 Salted SHA 256 hashed password
I have a SSHA256 hashed password. Below is the plaintext and hashed password for it.
PlainText -p@ssw0rd
Encrypted -{SSHA256}LGkJJV6e7wPDKEr3BKSg0K0XDllewz9tvSNSaslDmIfPFmyuI5blUK/...
- 125
0
votes
1
answer
150
views
Find pre-images of hashed email addresses
This is a cryptographic challenge I was given:
I have a list of 1000 hashed email addresses where I know the domain name for them (eg. "@gmail.com").
According to hashes.com:
Possible ...
0
votes
2
answers
91
views
When using a user password for client side encryption, do I have to store the salt for the user encryption key on the server?
The password of the user shall be used for client side encryption. A PBKDF and salt shall be used to derive a key from the user password.
Do I need to store this salt on the server and deliver it to ...
- 707
2
votes
3
answers
248
views
Is using random salt to pbkdf2 for every request to Rest API good/bad?
Here are my conditions:
My Rest API must accept username and plain password. But, that's very bad. That's why the client must encrypt the password first and my rest API will decrypt it to get the ...
- 121
1
vote
0
answers
141
views
Choosing the right salt to pseudo-anonymize data and be GDPR compliant
In my company, numeric user IDs are considered PIIs and therefore need to be pseudo-anonymized to be GDPR compliant.
To do so, we populate a lookup table where to each ID is assigned a monotonically ...
- 111
0
votes
1
answer
377
views
Is pbkdf2 with hmac using md5 still secure?
I have an old system that can do PBKDF2 with HMAC using MD5, but not SHA-2. Now I know that MD5 is insecure and shouldn't be used for new applications, but https://crypto.stackexchange.com/a/9340/...
- 1,146
0
votes
2
answers
3k
views
Does John the Ripper automatically account for salt and hash?
I have an embedded device running Armbian which I was able to get the drive image from. The entry in /etc/shadow combined with /etc/passwd after unshadowing is this:
root:$6$TV6ML2bG$TncnN/adtU9xaQs/...
2
votes
1
answer
331
views
How can I use a unique salt for each user
I know there are various questions that seem similar, for instance, this one. However, it does not answer my question.
I'm creating a signup/login system (with node.js to be particular), and I'm ...
- 23
17
votes
1
answer
6k
views
How can Freeradius detect if the password provided is right when only the salted hash is stored in the database without the salt
I am discovering both Freeradius and the password hashing mechanism. I built a database (in MySQL) to store the passwords of some users. I have a user with the password in clear text, another one ...
- 173
3
votes
1
answer
313
views
How can salted passwords work if you don't "keep the salts in the system"?
In this report on the recent ParkMobile breach, the article has this comment from the company:
“You are correct that bcrypt hashed and salted passwords were obtained,” Perkins said when asked about ...
- 207
1
vote
1
answer
116
views
Is combining salt from two places secure enough and what length
I need to implement some hashing scheme for an open-source project. This is what I currently have and I'd like to hear whether this is secure enough -
The password is hashed using PBKDF2-SHA256 (which ...
- 113
0
votes
0
answers
64
views
Is salt even secure once hacker has access to the database? [duplicate]
I have seen so many articles which they write that the salt is stored together with the hashed password in the database. However, there's one thing that is bugging me. Since the plain text salt is ...
- 9
0
votes
1
answer
198
views
Sending and blocking emails from hashed and salted address ? (for GDPR)
I would like to send emails from a server, but also make them unable to trace for me as server owner or attackers. I want this for GDPR but also to protect people from abusers.
Short info about ...
user250107
10
votes
4
answers
3k
views
Alternatives for sending plaintext password while login
Note: I've already read Is it ok to send plain-text password over HTTPS? and https security - should password be hashed server-side or client-side?, but here it's about a specific replacement method (...
- 951
0
votes
3
answers
177
views
Problem understanding salting
I'm a beginner in Information Security and am learning about salting. Unfortunately, most of the time I have to learn by myself since the lecturer doesn't provide deep explanation on these. I now have ...
0
votes
0
answers
89
views
Time it will take to crack a password file? [duplicate]
I'm trying to answer a multiple-choice question which is the following:
"Consider the security of a password file, which includes a 10 bit
salt and all passwords are hashed, but known to consist ...
21
votes
3
answers
4k
views
Does complexity of salt in password hashing matter?
I have no cyber security knowledge whatsoever, and am trying to safely store passwords in a database. I understood I need to use salt, to avoid rainbow table attacks and to make sure two users with ...
- 313
2
votes
1
answer
226
views
Password salting vs. length extension attacks
I read that when salting passwords, it is advised to use a h(pwd||salt) construction instead of h(salt||pwd), the latter being vulnerable to a length extension attack.
What are possible scenarios in ...
- 21
0
votes
2
answers
182
views
Is adding encryption before hashing more secure?
One way to secure a password in the database is to hash it with salt i.e. appending a random string to the password and then hash it and store the value.
Does encrypting the password || salt then ...
- 137
0
votes
1
answer
296
views
Modifying a SHA256 system to be ASIC resistant
I am looking for a way to protect a system utilizing SHA256 on semi-weak passwords against brute force attacks using ASIC-levels of hash-power, ideally by designing a system that is ASIC resistant.
...
- 103
0
votes
1
answer
482
views
Encrypting salted password hash before storing in the database
I have read here and here, that instead of using pepper, it is better to encrypt hashed/salted passwords before storing in the database. Especially with Java, as there's no library for salt/pepper, ...
- 105
1
vote
1
answer
274
views
Why are salted hashes better than just hashing? [duplicate]
I have recently read an article about storing passwords safely and I have a few misunderstandings. I found out 4 ways of storing users' passwords:
Just keep them in plain text
Keep passwords in plain ...
- 13
2
votes
1
answer
3k
views
Is it possible to reverse a sha256 hashed value if we know part of the input value?
I'm a total noob, so please help me out.
Suppose something is hashed in sha256. If we know the value of some part of the hashed text, can we figure out the entire text?
Ex: xxxxxx + j4l58jl6j4l6j4 = ...
- 23
1
vote
1
answer
129
views
sql injection mitigation by signed db entries?
In a php/mysql based system I work on, they recently found several SQL injection vulnerabilities. Those come from 3rd party plugins, and I must assume there are more to be discovered.
My major concern ...
- 193
3
votes
1
answer
842
views
Why people say that salt helps to prevent rainbow table attack? [duplicate]
I am using some frameworks that store salts inside databases. For example this article shows how Devise stores salt together with the user information. My question is why do people say that salts ...
- 465
1
vote
2
answers
176
views
Is necessary to use salt if I use a complex password? [closed]
I read that it is important to use a salt together with the password to avoid rainbow table attack. I agree with that, but is there any difference, in terms of security, if
I use password + salt or
I ...
- 465
13
votes
3
answers
6k
views
How does a 'rainbow table' hacker obtain password hashes in the first place?
I don't understand this part of the Rainbow table attack.
In all my Google searches, it says that a hacker uses a rainbow table on password hashes.
But how does the hacker obtain the password hashes ...
- 256
10
votes
3
answers
3k
views
Client side password hashing with static salt - did I find a breach?
I downloaded a software that has a login interface. It's a $100 a month subscription software.
I disassembled the software and found that passwords are being sent by combining them with a hard coded &...
- 203
2
votes
0
answers
459
views
What's the point of salting Double Submit Cookie (CSRF protection)?
Django web framework uses the Double Submit Cookie pattern for CSRF protection. (The CSRF token is sent in a cookie and also in a hidden form field. Incoming requests are checked for a match between ...
- 131
0
votes
1
answer
1k
views
Writing a Simple SHA256 Salted Hash Generator
I saw a video detailing how to write a simple salted hash program in C# here. Below is the code they wrote (slightly edited for console applications):
using System;
using System.Text;
using System....
- 159
2
votes
1
answer
304
views
Oversalting Potentially Harmful?
I find it hard to believe, and figure I just missed or forgot something obvious (years since I thought about this stuff), so maybe someone can point it out. But it seems like most of what I know about ...
- 379
0
votes
1
answer
208
views
Can a salt be a random ASCII string or be derived from one?
I'm using a KDF (PBKDF2HMAC) to generate a Fernet key from a given password, but to do so I also need to generate and store a salt.
import base64
import os
from cryptography.fernet import ...
- 135
0
votes
1
answer
1k
views
Can't solve format for Salted SHA1 hashes with Hashcat?
I am attempting to understand the format for this Salted SHA1 hash for an assignment. The line of text I was given was:
nameExample@email.com,nameExample,nameExample@email.com,nameExample,,,...
-1
votes
1
answer
104
views
Using a Pepper as the index to insert a salt
In this question on this board the author of the selected answer states the following.
If you, as an attacker, manage to extract hashes and salts from a database, you probably either find a way to ...
6
votes
1
answer
7k
views
Which part of this encoded Argon2 hash is the salt?
I was reading the post Is it safe/wise to store a salt in the same field as the hashed password?:
$argon2i$v=19$m=65536,t=3,p=1$YOtX2//7NoD/owm8RZ8llw==$fPn4sPgkFAuBJo3M3UzcGss3dJysxLJdPdvojRF20ZE=
...
- 75
1
vote
3
answers
156
views
Using two salts - one stored with the password, one stored in a random row in a separate table
Imagine a login system is being created, and a user's password is hashed thusly:
Users.password = PBKDF2(salt1 + password + salt2)
The result of that ^ operation and salt1 are stored side-by-side in ...
- 13
30
votes
9
answers
8k
views
Is there a way to add salted hashing to my user authentication without breaking my former login server
I am presented with the following scenario:
I have a MySQL-Database with a table of users. The table has two fields: username and password. The password is stored as an unsalted hash.
An over 15 ...
- 403
0
votes
1
answer
138
views
should giving salt to unauthenticated users be a problem
Let's say i have a scenario when the user salt is required in client side before login,
the user obtains the salt by this url http://my-api.example/get-salt/userid
that url should return a salt for ...
user212160