Questions tagged [salt]
A salt is a random addition to a password to make the hashed password less susceptible to a lookup table attack
375
questions
0
votes
0
answers
85
views
What to do if i have no salt?
Here is my situation : we've got ID, named TIP, from remote and large databases. We want to store all the data, but laws prevents us to store the TIP directly, but rather anonymize them, for security ...
- 133
1
vote
1
answer
143
views
Two different salted hashes of the same password for the same user
I am creating an authentication system that is able to login to the same account with different sets of credentials. I also want to allow users to login with either username or email with the same ...
- 11
1
vote
1
answer
211
views
What is the effect of salt and no. of rounds in mkpasswd encryption?
I'm currently trying to understand how salting and no. of rounds work using mkpasswd. These are the commands that I have been experimenting around.
cp@cp-vm:~/Asg2_Task1b$ time mkpasswd -m sha-512 ...
- 11
2
votes
1
answer
515
views
Crack with Hashcat using hash and salt
I am new to Hashcat and I am trying to crack a password/salt hash. Everything I have tried comes back as "no hash-mode matches..." Any assistance on the correct hashcat command line would ...
1
vote
0
answers
34
views
How should an argon2 hash be stored? [duplicate]
Given the following argon2 hash
$argon2id$v=19$m=65536,t=32,p=8$mJmKA5qamzXOPJZYw4wCEUKY$COkMH0RckaZ/3bhYCdCQjLuzoLKxcAmk4TzmHRRgTQ8
How should the hash be stored in a database? From the answers of ...
- 11
0
votes
1
answer
212
views
Storing two hashes of same password?
Typically for user passwords we store their hashes and salt alongside in the database - one per user.
I wonder the security implications of hashing the same password twice and storing locally both.
...
3
votes
4
answers
2k
views
Using a Client and Server secret to double salt a hash
I want to log IP addresses visiting my site, for aggregated statistics only and to see if the same IP address has visited twice. But I don't want to expose them.
My Idea is in my database.
$...
- 131
1
vote
1
answer
194
views
Is it secure to expose a salted bcrypt hash IF it is maximum length random secure password?
Is it secure to expose a salted bcrypt hash (minimum 14 cost) if the used password is 72 characters (maximum) byte long, randomly generated letters, numbers, and special characters using secure ...
- 13
15
votes
1
answer
5k
views
Is it a good practice to add hard-coded salt to BCrypt passwords?
I am currently learning about cybersecurity and trying to implement it in my next web application.
I have been reading some articles about hashing, specifically SHA2 and Blowfish.
In this article, it ...
1
vote
0
answers
31
views
Can parts of WebCrypto AES-GCM be reused between encryptions
I am trying to better understand the processes involved in e2ee using WebCrypto on the browser.
I understand that the only real method to use a passphrase to generate a symmetric key on the browser is ...
- 111
1
vote
2
answers
325
views
Using hash to search encrypted records
If I am using SHA-512 hash values merely as a means to search fields that have been encrypted elsewhere, is it cryptographically secure enough to hash without salt?
For background, I have been given a ...
- 111
0
votes
1
answer
87
views
Why GNU libc's salt alphabet for `crypt` is limited to ./0-9A-Za-z?
According to docs:
To hash a new passphrase for storage, set salt to a string consisting of [a prefix plus] a sequence of randomly chosen characters ...
and
In all cases, the random characters ...
- 103
1
vote
1
answer
119
views
Does recalculating per-user salt every time a user changes password make any difference?
I have set it up so that when my users change their password, the salt is recomputed.
Besides hiding the fact that they may change their password to the same thing (I am checking that by first hashing ...
- 149
0
votes
0
answers
44
views
What are the underlying mechanics that make password salting an effective deterrent against Rainbow Tables? [duplicate]
I have a top level familiarity with Rainbow tables (1 ,2 )
I also understand that salting adds a randomly generated alphanumeric string to each password before it gets hashed and put in a database.
My ...
3
votes
1
answer
175
views
Does this theoretical salted-hash-sleep scheme mitigate timing attacks?
This question is purely theoretical, I have no intention of ever implementing this scheme in practice. I'm familiar with the shortcomings of sleeping as means of mitigating timing attacks. I'm more ...
- 133
4
votes
1
answer
567
views
Hashing to protect privacy
I like to know if hashing protects privacy enough, i.e., if a hash of PII is still considered to be personally identifying information (PII).
I found this article: https://www.johndcook.com/blog/2019/...
- 41
1
vote
2
answers
173
views
Design for deleting users accounts, yet knowing when they register again
My webapp takes in email addresses as user names at registration, verifies ownership by sending emails with confirmation links, etc.
I'm now looking for a secure design of a user deletion feature, ...
- 373
1
vote
1
answer
1k
views
HMAC SHA256 by using a static key + text as a key
Maybe it's not a good idea, but I would like to check it with you.
When using HMAC SHA to hash a clear text value (string max 30 char) I need to use a key (256) but in my scenario this key is static ...
- 59
0
votes
2
answers
409
views
How different ldap implementations are generating random salt?
I am currently generating a salted SHA 256 passwords in the below format
$hash = "{SHA256}".base64_encode(hash('sha256', $password . $salt) . $salt) .
Using the below libraries of Java ...
- 125
2
votes
3
answers
5k
views
How can I extract salt from encoded base64 Salted SHA 256 hashed password
I have a SSHA256 hashed password. Below is the plaintext and hashed password for it.
PlainText -p@ssw0rd
Encrypted -{SSHA256}LGkJJV6e7wPDKEr3BKSg0K0XDllewz9tvSNSaslDmIfPFmyuI5blUK/...
- 125
0
votes
1
answer
219
views
Find pre-images of hashed email addresses
This is a cryptographic challenge I was given:
I have a list of 1000 hashed email addresses where I know the domain name for them (eg. "@gmail.com").
According to hashes.com:
Possible ...
0
votes
2
answers
120
views
When using a user password for client side encryption, do I have to store the salt for the user encryption key on the server?
The password of the user shall be used for client side encryption. A PBKDF and salt shall be used to derive a key from the user password.
Do I need to store this salt on the server and deliver it to ...
- 717
2
votes
3
answers
471
views
Is using random salt to pbkdf2 for every request to Rest API good/bad?
Here are my conditions:
My Rest API must accept username and plain password. But, that's very bad. That's why the client must encrypt the password first and my rest API will decrypt it to get the ...
- 121
1
vote
1
answer
246
views
Choosing the right salt to pseudo-anonymize data and be GDPR compliant
In my company, numeric user IDs are considered PIIs and therefore need to be pseudo-anonymized to be GDPR compliant.
To do so, we populate a lookup table where to each ID is assigned a monotonically ...
- 111
0
votes
1
answer
649
views
Is pbkdf2 with hmac using md5 still secure?
I have an old system that can do PBKDF2 with HMAC using MD5, but not SHA-2. Now I know that MD5 is insecure and shouldn't be used for new applications, but https://crypto.stackexchange.com/a/9340/...
- 1,206
0
votes
2
answers
5k
views
Does John the Ripper automatically account for salt and hash?
I have an embedded device running Armbian which I was able to get the drive image from. The entry in /etc/shadow combined with /etc/passwd after unshadowing is this:
root:$6$TV6ML2bG$TncnN/adtU9xaQs/...
2
votes
1
answer
498
views
How can I use a unique salt for each user
I know there are various questions that seem similar, for instance, this one. However, it does not answer my question.
I'm creating a signup/login system (with node.js to be particular), and I'm ...
- 23
17
votes
1
answer
7k
views
How can Freeradius detect if the password provided is right when only the salted hash is stored in the database without the salt
I am discovering both Freeradius and the password hashing mechanism. I built a database (in MySQL) to store the passwords of some users. I have a user with the password in clear text, another one ...
- 173
3
votes
1
answer
330
views
How can salted passwords work if you don't "keep the salts in the system"?
In this report on the recent ParkMobile breach, the article has this comment from the company:
“You are correct that bcrypt hashed and salted passwords were obtained,” Perkins said when asked about ...
- 207
1
vote
1
answer
159
views
Is combining salt from two places secure enough and what length
I need to implement some hashing scheme for an open-source project. This is what I currently have and I'd like to hear whether this is secure enough -
The password is hashed using PBKDF2-SHA256 (which ...
- 113
0
votes
0
answers
64
views
Is salt even secure once hacker has access to the database? [duplicate]
I have seen so many articles which they write that the salt is stored together with the hashed password in the database. However, there's one thing that is bugging me. Since the plain text salt is ...
- 9
0
votes
1
answer
262
views
Sending and blocking emails from hashed and salted address ? (for GDPR)
I would like to send emails from a server, but also make them unable to trace for me as server owner or attackers. I want this for GDPR but also to protect people from abusers.
Short info about ...
user250107
11
votes
4
answers
5k
views
Alternatives for sending plaintext password while login
Note: I've already read Is it ok to send plain-text password over HTTPS? and https security - should password be hashed server-side or client-side?, but here it's about a specific replacement method (...
- 963
0
votes
3
answers
186
views
Problem understanding salting
I'm a beginner in Information Security and am learning about salting. Unfortunately, most of the time I have to learn by myself since the lecturer doesn't provide deep explanation on these. I now have ...
0
votes
0
answers
96
views
Time it will take to crack a password file? [duplicate]
I'm trying to answer a multiple-choice question which is the following:
"Consider the security of a password file, which includes a 10 bit
salt and all passwords are hashed, but known to consist ...
21
votes
3
answers
4k
views
Does complexity of salt in password hashing matter?
I have no cyber security knowledge whatsoever, and am trying to safely store passwords in a database. I understood I need to use salt, to avoid rainbow table attacks and to make sure two users with ...
- 313
2
votes
1
answer
274
views
Password salting vs. length extension attacks
I read that when salting passwords, it is advised to use a h(pwd||salt) construction instead of h(salt||pwd), the latter being vulnerable to a length extension attack.
What are possible scenarios in ...
- 21
0
votes
2
answers
198
views
Is adding encryption before hashing more secure?
One way to secure a password in the database is to hash it with salt i.e. appending a random string to the password and then hash it and store the value.
Does encrypting the password || salt then ...
- 137
0
votes
1
answer
382
views
Modifying a SHA256 system to be ASIC resistant
I am looking for a way to protect a system utilizing SHA256 on semi-weak passwords against brute force attacks using ASIC-levels of hash-power, ideally by designing a system that is ASIC resistant.
...
- 103
0
votes
1
answer
745
views
Encrypting salted password hash before storing in the database
I have read here and here, that instead of using pepper, it is better to encrypt hashed/salted passwords before storing in the database. Especially with Java, as there's no library for salt/pepper, ...
- 105
1
vote
1
answer
300
views
Why are salted hashes better than just hashing? [duplicate]
I have recently read an article about storing passwords safely and I have a few misunderstandings. I found out 4 ways of storing users' passwords:
Just keep them in plain text
Keep passwords in plain ...
- 13
2
votes
1
answer
5k
views
Is it possible to reverse a sha256 hashed value if we know part of the input value?
I'm a total noob, so please help me out.
Suppose something is hashed in sha256. If we know the value of some part of the hashed text, can we figure out the entire text?
Ex: xxxxxx + j4l58jl6j4l6j4 = ...
- 23
1
vote
1
answer
134
views
sql injection mitigation by signed db entries?
In a php/mysql based system I work on, they recently found several SQL injection vulnerabilities. Those come from 3rd party plugins, and I must assume there are more to be discovered.
My major concern ...
- 193
3
votes
1
answer
981
views
Why people say that salt helps to prevent rainbow table attack? [duplicate]
I am using some frameworks that store salts inside databases. For example this article shows how Devise stores salt together with the user information. My question is why do people say that salts ...
- 465
1
vote
2
answers
201
views
Is necessary to use salt if I use a complex password? [closed]
I read that it is important to use a salt together with the password to avoid rainbow table attack. I agree with that, but is there any difference, in terms of security, if
I use password + salt or
I ...
- 465
13
votes
3
answers
7k
views
How does a 'rainbow table' hacker obtain password hashes in the first place?
I don't understand this part of the Rainbow table attack.
In all my Google searches, it says that a hacker uses a rainbow table on password hashes.
But how does the hacker obtain the password hashes ...
- 256
10
votes
3
answers
3k
views
Client side password hashing with static salt - did I find a breach?
I downloaded a software that has a login interface. It's a $100 a month subscription software.
I disassembled the software and found that passwords are being sent by combining them with a hard coded &...
- 203
2
votes
0
answers
574
views
What's the point of salting Double Submit Cookie (CSRF protection)?
Django web framework uses the Double Submit Cookie pattern for CSRF protection. (The CSRF token is sent in a cookie and also in a hidden form field. Incoming requests are checked for a match between ...
- 131
0
votes
1
answer
2k
views
Writing a Simple SHA256 Salted Hash Generator
I saw a video detailing how to write a simple salted hash program in C# here. Below is the code they wrote (slightly edited for console applications):
using System;
using System.Text;
using System....
- 159
2
votes
1
answer
316
views
Oversalting Potentially Harmful?
I find it hard to believe, and figure I just missed or forgot something obvious (years since I thought about this stuff), so maybe someone can point it out. But it seems like most of what I know about ...
- 379