Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.

Questions tagged [salt]

A salt is a random addition to a password to make the hashed password less susceptible to a lookup table attack

Filter by
Sorted by
Tagged with
0 votes
1 answer
46 views

Does recalculating per-user salt every time a user changes password make any difference?

I have set it up so that when my users change their password, the salt is recomputed. Besides hiding the fact that they may change their password to the same thing (I am checking that by first hashing ...
user avatar
  • 123
0 votes
0 answers
30 views

What are the underlying mechanics that make password salting an effective deterrent against Rainbow Tables? [duplicate]

I have a top level familiarity with Rainbow tables (1 ,2 ) I also understand that salting adds a randomly generated alphanumeric string to each password before it gets hashed and put in a database. My ...
user avatar
3 votes
1 answer
142 views

Does this theoretical salted-hash-sleep scheme mitigate timing attacks?

This question is purely theoretical, I have no intention of ever implementing this scheme in practice. I'm familiar with the shortcomings of sleeping as means of mitigating timing attacks. I'm more ...
user avatar
3 votes
1 answer
72 views

Hashing to protect privacy

I like to know if hashing protects privacy enough, i.e., if a hash of PII is still considered to be personally identifying information (PII). I found this article: https://www.johndcook.com/blog/2019/...
user avatar
  • 31
0 votes
2 answers
55 views

Design for deleting users accounts, yet knowing when they register again

My webapp takes in email addresses as user names at registration, verifies ownership by sending emails with confirmation links, etc. I'm now looking for a secure design of a user deletion feature, ...
user avatar
0 votes
1 answer
68 views

HMAC SHA256 by using a static key + text as a key

Maybe it's not a good idea, but I would like to check it with you. When using HMAC SHA to hash a clear text value (string max 30 char) I need to use a key (256) but in my scenario this key is static ...
user avatar
0 votes
2 answers
92 views

How different ldap implementations are generating random salt?

I am currently generating a salted SHA 256 passwords in the below format $hash = "{SHA256}".base64_encode(hash('sha256', $password . $salt) . $salt) . Using the below libraries of Java ...
user avatar
2 votes
3 answers
405 views

How can I extract salt from encoded base64 Salted SHA 256 hashed password

I have a SSHA256 hashed password. Below is the plaintext and hashed password for it. PlainText -p@ssw0rd Encrypted -{SSHA256}LGkJJV6e7wPDKEr3BKSg0K0XDllewz9tvSNSaslDmIfPFmyuI5blUK/...
user avatar
0 votes
1 answer
83 views

Find pre-images of hashed email addresses

This is a cryptographic challenge I was given: I have a list of 1000 hashed email addresses where I know the domain name for them (eg. "@gmail.com"). According to hashes.com: Possible ...
user avatar
0 votes
1 answer
58 views

When using a user password for client side encryption, do I have to store the salt for the user encryption key on the server?

The password of the user shall be used for client side encryption. A PBKDF and salt shall be used to derive a key from the user password. Do I need to store this salt on the server and deliver it to ...
user avatar
  • 695
2 votes
3 answers
199 views

Is using random salt to pbkdf2 for every request to Rest API good/bad?

Here are my conditions: My Rest API must accept username and plain password. But, that's very bad. That's why the client must encrypt the password first and my rest API will decrypt it to get the ...
user avatar
1 vote
0 answers
106 views

Choosing the right salt to pseudo-anonymize data and be GDPR compliant

In my company, numeric user IDs are considered PIIs and therefore need to be pseudo-anonymized to be GDPR compliant. To do so, we populate a lookup table where to each ID is assigned a monotonically ...
user avatar
  • 111
0 votes
1 answer
200 views

Is pbkdf2 with hmac using md5 still secure?

I have an old system that can do PBKDF2 with HMAC using MD5, but not SHA-2. Now I know that MD5 is insecure and shouldn't be used for new applications, but https://crypto.stackexchange.com/a/9340/...
user avatar
  • 1,126
0 votes
2 answers
1k views

Does John the Ripper automatically account for salt and hash?

I have an embedded device running Armbian which I was able to get the drive image from. The entry in /etc/shadow combined with /etc/passwd after unshadowing is this: root:$6$TV6ML2bG$TncnN/adtU9xaQs/...
user avatar
2 votes
1 answer
209 views

How can I use a unique salt for each user

I know there are various questions that seem similar, for instance, this one. However, it does not answer my question. I'm creating a signup/login system (with node.js to be particular), and I'm ...
user avatar
  • 23
17 votes
1 answer
6k views

How can Freeradius detect if the password provided is right when only the salted hash is stored in the database without the salt

I am discovering both Freeradius and the password hashing mechanism. I built a database (in MySQL) to store the passwords of some users. I have a user with the password in clear text, another one ...
user avatar
  • 173
3 votes
1 answer
298 views

How can salted passwords work if you don't "keep the salts in the system"?

In this report on the recent ParkMobile breach, the article has this comment from the company: “You are correct that bcrypt hashed and salted passwords were obtained,” Perkins said when asked about ...
user avatar
1 vote
1 answer
102 views

Is combining salt from two places secure enough and what length

I need to implement some hashing scheme for an open-source project. This is what I currently have and I'd like to hear whether this is secure enough - The password is hashed using PBKDF2-SHA256 (which ...
user avatar
  • 113
0 votes
0 answers
64 views

Is salt even secure once hacker has access to the database? [duplicate]

I have seen so many articles which they write that the salt is stored together with the hashed password in the database. However, there's one thing that is bugging me. Since the plain text salt is ...
user avatar
  • 9
0 votes
1 answer
131 views

Sending and blocking emails from hashed and salted address ? (for GDPR)

I would like to send emails from a server, but also make them unable to trace for me as server owner or attackers. I want this for GDPR but also to protect people from abusers. Short info about ...
user avatar
10 votes
4 answers
3k views

Alternatives for sending plaintext password while login

Note: I've already read Is it ok to send plain-text password over HTTPS? and https security - should password be hashed server-side or client-side?, but here it's about a specific replacement method (...
user avatar
  • 941
0 votes
3 answers
168 views

Problem understanding salting

I'm a beginner in Information Security and am learning about salting. Unfortunately, most of the time I have to learn by myself since the lecturer doesn't provide deep explanation on these. I now have ...
user avatar
0 votes
0 answers
71 views

Time it will take to crack a password file? [duplicate]

I'm trying to answer a multiple-choice question which is the following: "Consider the security of a password file, which includes a 10 bit salt and all passwords are hashed, but known to consist ...
user avatar
21 votes
3 answers
4k views

Does complexity of salt in password hashing matter?

I have no cyber security knowledge whatsoever, and am trying to safely store passwords in a database. I understood I need to use salt, to avoid rainbow table attacks and to make sure two users with ...
user avatar
2 votes
1 answer
190 views

Password salting vs. length extension attacks

I read that when salting passwords, it is advised to use a h(pwd||salt) construction instead of h(salt||pwd), the latter being vulnerable to a length extension attack. What are possible scenarios in ...
user avatar
0 votes
2 answers
165 views

Is adding encryption before hashing more secure?

One way to secure a password in the database is to hash it with salt i.e. appending a random string to the password and then hash it and store the value. Does encrypting the password || salt then ...
user avatar
  • 137
0 votes
1 answer
251 views

Modifying a SHA256 system to be ASIC resistant

I am looking for a way to protect a system utilizing SHA256 on semi-weak passwords against brute force attacks using ASIC-levels of hash-power, ideally by designing a system that is ASIC resistant. ...
user avatar
0 votes
1 answer
368 views

Encrypting salted password hash before storing in the database

I have read here and here, that instead of using pepper, it is better to encrypt hashed/salted passwords before storing in the database. Especially with Java, as there's no library for salt/pepper, ...
user avatar
  • 105
1 vote
1 answer
247 views

Why are salted hashes better than just hashing? [duplicate]

I have recently read an article about storing passwords safely and I have a few misunderstandings. I found out 4 ways of storing users' passwords: Just keep them in plain text Keep passwords in plain ...
user avatar
  • 13
2 votes
1 answer
2k views

Is it possible to reverse a sha256 hashed value if we know part of the input value?

I'm a total noob, so please help me out. Suppose something is hashed in sha256. If we know the value of some part of the hashed text, can we figure out the entire text? Ex: xxxxxx + j4l58jl6j4l6j4 = ...
user avatar
1 vote
1 answer
122 views

sql injection mitigation by signed db entries?

In a php/mysql based system I work on, they recently found several SQL injection vulnerabilities. Those come from 3rd party plugins, and I must assume there are more to be discovered. My major concern ...
user avatar
3 votes
1 answer
730 views

Why people say that salt helps to prevent rainbow table attack? [duplicate]

I am using some frameworks that store salts inside databases. For example this article shows how Devise stores salt together with the user information. My question is why do people say that salts ...
user avatar
  • 465
1 vote
2 answers
162 views

Is necessary to use salt if I use a complex password? [closed]

I read that it is important to use a salt together with the password to avoid rainbow table attack. I agree with that, but is there any difference, in terms of security, if I use password + salt or I ...
user avatar
  • 465
13 votes
3 answers
6k views

How does a 'rainbow table' hacker obtain password hashes in the first place?

I don't understand this part of the Rainbow table attack. In all my Google searches, it says that a hacker uses a rainbow table on password hashes. But how does the hacker obtain the password hashes ...
user avatar
10 votes
3 answers
3k views

Client side password hashing with static salt - did I find a breach?

I downloaded a software that has a login interface. It's a $100 a month subscription software. I disassembled the software and found that passwords are being sent by combining them with a hard coded &...
user avatar
  • 203
2 votes
0 answers
326 views

What's the point of salting Double Submit Cookie (CSRF protection)?

Django web framework uses the Double Submit Cookie pattern for CSRF protection. (The CSRF token is sent in a cookie and also in a hidden form field. Incoming requests are checked for a match between ...
user avatar
  • 131
0 votes
1 answer
525 views

Writing a Simple SHA256 Salted Hash Generator

I saw a video detailing how to write a simple salted hash program in C# here. Below is the code they wrote (slightly edited for console applications): using System; using System.Text; using System....
user avatar
2 votes
1 answer
292 views

Oversalting Potentially Harmful?

I find it hard to believe, and figure I just missed or forgot something obvious (years since I thought about this stuff), so maybe someone can point it out. But it seems like most of what I know about ...
user avatar
  • 379
0 votes
1 answer
175 views

Can a salt be a random ASCII string or be derived from one?

I'm using a KDF (PBKDF2HMAC) to generate a Fernet key from a given password, but to do so I also need to generate and store a salt. import base64 import os from cryptography.fernet import ...
user avatar
  • 135
0 votes
1 answer
1k views

Can't solve format for Salted SHA1 hashes with Hashcat?

I am attempting to understand the format for this Salted SHA1 hash for an assignment. The line of text I was given was: nameExample@email.com,nameExample,nameExample@email.com,nameExample,,,...
user avatar
-1 votes
1 answer
102 views

Using a Pepper as the index to insert a salt

In this question on this board the author of the selected answer states the following. If you, as an attacker, manage to extract hashes and salts from a database, you probably either find a way to ...
user avatar
7 votes
1 answer
5k views

Which part of this encoded Argon2 hash is the salt?

I was reading the post Is it safe/wise to store a salt in the same field as the hashed password?: $argon2i$v=19$m=65536,t=3,p=1$YOtX2//7NoD/owm8RZ8llw==$fPn4sPgkFAuBJo3M3UzcGss3dJysxLJdPdvojRF20ZE= ...
user avatar
1 vote
3 answers
154 views

Using two salts - one stored with the password, one stored in a random row in a separate table

Imagine a login system is being created, and a user's password is hashed thusly: Users.password = PBKDF2(salt1 + password + salt2) The result of that ^ operation and salt1 are stored side-by-side in ...
user avatar
  • 13
30 votes
9 answers
8k views

Is there a way to add salted hashing to my user authentication without breaking my former login server

I am presented with the following scenario: I have a MySQL-Database with a table of users. The table has two fields: username and password. The password is stored as an unsalted hash. An over 15 ...
user avatar
  • 403
0 votes
1 answer
138 views

should giving salt to unauthenticated users be a problem

Let's say i have a scenario when the user salt is required in client side before login, the user obtains the salt by this url http://my-api.example/get-salt/userid that url should return a salt for ...
user avatar
1 vote
1 answer
168 views

Password hashing with salt. Where do you leave the salt? [duplicate]

I want to hash a set of sensitive data using a hash+salt. I've done a little research and now I know that: The salt should be random. The salt should not be reused. Using hashing without salt makes ...
user avatar
0 votes
1 answer
239 views

How should we apply the salt to the password? [duplicate]

According to Wikipedia: A rainbow table is ineffective against one-way hashes that include large salts. For example, consider a password hash that is generated using the following function (where "|...
user avatar
2 votes
2 answers
274 views

Am I using RfcDeriveBytes correctly, when the salt I'm providing it contains the password?

I'm using Rfc2898DeriveBytes in my application to encrypt a password with a randomly generated salt, and with a set iterator count for slowness. Before, I just grabbed the generated salt and put it ...
user avatar
  • 155
2 votes
3 answers
1k views

Anonymizing IP addresses using (sha) hashes; how to circumvent rainbow table attacks?

Under GDPR, IP addresses are personal data. I have no need to trace back IP to specific users, but I would like to limit downloads to one per IP.* I do not want to store plain IPs. My first solution ...
user avatar
  • 123
22 votes
8 answers
6k views

How can I re-use my password and still protect the password if it is exposed from one source?

I know that all servers should at least store my credentials as hash(password + salt) + salt, with a secure and well known hash function and a salt unique for me, generated from a secure and well ...
user avatar
  • 389

1
2 3 4 5
8