Skip to main content

Questions tagged [salt]

A salt is a random addition to a password to make the hashed password less susceptible to a lookup table attack

Filter by
Sorted by
Tagged with
1 vote
3 answers
2k views

By how much does the addition of a salt slow down a rainbow table attack?

I understand that the addition of a salt provides some protection, because the attacker can no longer just look up the hash value in a rainbow table. However, it is still feasible to write a cracking ...
Legend of Overfiend's user avatar
1 vote
2 answers
191 views

Can we simply re-salt password on suspected session hijack?

Looking at people complaining about Yahoo forcing users to change their passwords. We can see that people do not particularly like to change passwords (and whether we change them regularly is an ...
grochmal's user avatar
  • 5,877
3 votes
2 answers
2k views

Why does saving a salt as plain text still improve security? [duplicate]

I mean, for example you use salting to protect your password against a dictionary attack. But when I know that the salt from User X is jd38d83h8fh08h (because it is saved as plain text together with ...
idontknowwhoiamgodhelpme's user avatar
-1 votes
3 answers
842 views

Biometric fingerprint as salt for hash function

Sorry, might be a stupid question: But is there any hash function, which use the biometric fingerprint as salt? First, the User enters his plaintext password, second he use his fingerprint - some ...
idontknowwhoiamgodhelpme's user avatar
8 votes
1 answer
1k views

LastPass's use of client-side Salt

The LastPass Team states the following in their FAQ: Do you use a salted hash for logging in? Yes, we first do a 'salt' of your LastPass password with your username on the client side (on ...
Oliver Weichhold's user avatar
2 votes
1 answer
2k views

Why not use username as a password salt? [duplicate]

The point of salting your password hashes is to prevent the attacker from using an off-the-shelf rainbow table. The salt needs to be unique per user, but doesn't need to be secret. Why not use the ...
Mike Ounsworth's user avatar
3 votes
1 answer
731 views

Any reason to send a user a session salt?

I'm a summer intern turned full time employee. To make a long story short, the lead developer of the project I interned on quit, and since I'm the only other person that knows the project I got hired ...
UIDAlexD's user avatar
  • 133
1 vote
2 answers
697 views

Are salts and password hashing needed for random keys?

I know that salts protect against rainbow tables, and I also know that hashing a password a certain number of times increases the strength of encryption, with more times of hashing being better. But ...
Michael's user avatar
  • 409
3 votes
2 answers
721 views

What's the best way to salt a useragent string?

What would be the best way to salt a periodically changing useragent string, so as to avert browser fingerprinting? For example, a useragent string like this: Mozilla/5.0 (X11; Linux x86_64; rv:50....
Geremia's user avatar
  • 1,783
1 vote
0 answers
293 views

Generating Rainbow Tables with Salt/Prefix [closed]

I would need a tool that would allow me to create rainbow table for custom password pattern. The pattern is 9-XXXXXXXXX where X is alphanumberic character and 9- is fixed prefix, as well as fixed ...
P. Kon's user avatar
  • 11
54 votes
3 answers
11k views

Secret salts; why do they slow down attacker more than they do me?

When studying Dan Boneh's slides for 'Session Management and User Authentication' (2011) he mentions 'secret salts' on the slide 'Further defences' (slide 48 out of 58). He suggest to store in the ...
harm's user avatar
  • 593
3 votes
2 answers
3k views

Is it secure to store the salt along with the hashed password in the database? [duplicate]

After reading some posts and articles about how to store user credentials in a database, in which all said that we should use a different salt for each user and save the salt in the database along ...
André Morais's user avatar
3 votes
6 answers
1k views

Is it safe to use HMAC with a public key for the purpose of salting?

I would like to store password hashes in a database. In order to prevent dictionary attacks, I was thinking to use HMAC with a key parameter which is public - like user id. That means the user id ...
toni77's user avatar
  • 179
1 vote
2 answers
568 views

At what table size does salt reuse make rainbow tables cost effective?

While I know that salt should never be reused, I'm interested in whether it is a significant problem if we only have a small number of hashes for which it is reused. So let's say we have a table with ...
sashoalm's user avatar
  • 587
0 votes
0 answers
143 views

Possible Session Key Security Weakness

I found a website that generates its session keys by hashing the userid (more or less public data) and the password together with MD5. Sessionkey = md5sum(userid+password) I am fairly new to this ...
licklake's user avatar
  • 1,062
2 votes
4 answers
3k views

How to figure about the total amount of password combinations possibles that have salt values?

I'm reading this book about Computer Security to better prepare me for my role, however, this question is just not clicking to me. I've figured out half of it, but cannot figure out this last part. If ...
user125642's user avatar
5 votes
2 answers
150 views

Can you feed old unsalted hashes to a salted PBKDF function to increase security?

Suppose BigBusiness™ Inc. Ltd. built a web service in 1995, storing their user passwords using bleeding-edge technology: unsalted md5 hashes. Now they realize that this was probably a bad idea and ...
Fritz's user avatar
  • 149
-1 votes
2 answers
13k views

What type of hashes are these and what are salts? [closed]

These are hashes and salts but I don't know what the salt is. The salts are under the hashes and theyre short. Also, I don't know how to crack these hashes, can anyone help? --------------+----------...
Jwan Hussen's user avatar
0 votes
2 answers
133 views

Does this count as unique salting against rainbow tables

**Due to the limitations of my situation the exe (i.e. source), hash, salt, everything is stored locally as it's a local application. Would this idea beat rainbow tables? Password = Input (always 8 ...
ian smith's user avatar
1 vote
3 answers
3k views

Is md5(md5(password).salt) secure? [duplicate]

I know md5 is considered non-secure but what if someone used md5(md5(password).salt) instead? Isn't this technically better / more secure?
user51819's user avatar
  • 127
1 vote
2 answers
9k views

AES-256-CBC encryption IV vs salt when encrypting files with a secret key

I am writing a small class to add to my application that will handle things like config secrets. (I don't want to get into this topic as a lot of research has gone into the approach we've decided to ...
CameronGo's user avatar
0 votes
1 answer
948 views

Should I really salt in a RSA/AES hybrid connection?

I start by saying that I'm pretty new to encryption and I'm pretty bad at finding weakness in everything. Said so, i'd like to talk about an huge doubt I'd like to clarify before I end up doing ...
Asduffo's user avatar
1 vote
0 answers
113 views

Should a unique CRA password salt travel the wire?

In an authentication method I am using an auth-framework which runs an implementation of CRA which forwards salt (with key length / iterations), challenge to the client. With this information the ...
Simon Kemper's user avatar
1 vote
2 answers
839 views

Authentication over SSL using hash and salt

I have researched this topic exhaustively and am stuck -- was hoping to get some clarification from helpful folks. Background: I have Bluetooth transponders attached to locks that are opened by ...
user3682157's user avatar
5 votes
5 answers
5k views

Why can salts be public? [duplicate]

From what I understand, salts are called "salts" rather than "keys" because they are allowed to be public. I understand that applying a random salt makes it difficult for rainbow table attacks because ...
Timothy Deng's user avatar
0 votes
0 answers
246 views

Hashing with unknown salt security

First off, this question is not about password hashing, my requirements are different. In particular I fully agree that salts are not useful for adding cryptographical complexity in password hashes, ...
Claude's user avatar
  • 241
3 votes
2 answers
2k views

Storing Password Hash plaintext

I've been doing some research on password hashing/salting. It is my understanding that the salt doesn't need to be secret. But I haven't read anything about the hash itself needing to be secret. How ...
Programmer001's user avatar
6 votes
3 answers
33k views

How hard would it be to crack bcrypt hashes if the salt is unknown? [duplicate]

(This is not a duplicated of the linked question IMHO as this is more about the differences between a salt and password: both variables used to generate a hash) Let's say an attacker has offline ...
lepe's user avatar
  • 2,194
94 votes
10 answers
18k views

Does anybody not store salts?

We talked about password hashing and salting in class today. Our professor had a very different understanding of the use case of salts from mine and said that you might not store the salt at all and ...
jazzpi's user avatar
  • 1,059
2 votes
0 answers
125 views

TapLink's architecture [closed]

Can anyone describe how Taplink's proposed architecture would look like? I heard a very high-level pitch but found no detailed technical explanation. This is a proposed architecture to harden ...
0xF2's user avatar
  • 121
4 votes
1 answer
10k views

Find salt from md5 hash if password is known

I have a salted MD5 hash and I also know the password. How can I recover the salt using tools like John The Ripper (I have JTR jumbo installed)?
nikrom3000's user avatar
0 votes
2 answers
394 views

Anonymisation better than just a hash

I'm trying to help anonymise users but still give them some controls. So this is different from say, anonymising a data set where you never need to go back to the original users. Let me give you an ...
Paul Fremantle's user avatar
2 votes
4 answers
3k views

How are salts safe in the database? [duplicate]

I have read many and many of this type of question on the security stack community before I asked this question, but one thing that made me mad about salts and saving it in database is this ... I will ...
ahmed nader's user avatar
4 votes
2 answers
982 views

Does a hash of a 32-bit integer make a better hash salt than the integer itself?

I have a scenario where I already have a table of resource passwords stored as unsalted 128-bit hashes. I'm unable to force owners to provide new passwords, so I'm trying to mitigate the situation by ...
user115439's user avatar
0 votes
2 answers
603 views

How secure is the hashing/salting/stretching process as described in this diagram?

Question I was just brainstorming about the hashing, stretching, salting part of the user password in the authentication process and I want it to be as secure as possible (no matter how paranoid that ...
Bob Ortiz's user avatar
  • 6,685
5 votes
3 answers
275 views

Does salting your own password improve security? [duplicate]

Let's say you were to add a couple of extra characters to your password, unique to each site you visit. The password would be largely similar except for a few characters of salt, possibly taken from ...
William's user avatar
  • 158
0 votes
1 answer
1k views

Encrypt password with salt

Can anyone explain why formula 1 is safer than formula 2?I don't get it even I get the answer. According to 2, it says as s is in plaintext form, the attacker can decrypt the password by (y.s). Isn'...
Ricky's user avatar
  • 135
4 votes
0 answers
2k views

How exactly does "Apache Shiro's" hashing work when using a Desktop-Client

I was looking at this question How does storing hash passwords work? and every answer essentially says that Hashing is done via the server, or most of it should, as that is the safest way to do it. I ...
XaolingBao's user avatar
39 votes
8 answers
6k views

Find matching phone numbers without actually knowing them

We have a mobile app that, given two users, needs to let them see what common contacts they have based on their phone numbers. How can we do this in a cryptographically secure way and respecting the ...
liviucmg's user avatar
  • 493
1 vote
1 answer
201 views

Secure WebApp authentication

I know there are many questions about hashing passwords on the client side out there, but none of them, which I found, address my use case. My app will be end-to-end-encrypted and it is not an option ...
Hendrik's user avatar
  • 45
0 votes
1 answer
375 views

AES-CTR with PBKDF2 for IV for file archiving at server. Is this ok?

I have tried to grasp enough of encryption/hashing to be able to implement a secure storage for files, server side. Once I have it down to reasonably safe I'll go over it with an expert. There is no ...
Michael's user avatar
  • 177
3 votes
4 answers
532 views

Is knowing the salt a problem?

I understand that adding a salt would thwart the use of rainbow tables. I don't understand the time it would take to create a rainbow table for a certain salt and of course this is dependent on the ...
Dane's user avatar
  • 243
3 votes
3 answers
386 views

Is appending plaintext to salt equally safe as appending salt to plaintext

Is using hash(salt, plaintext) equally secure as using hash(plaintext, salt), i.e. can the plain text be appended to salt in place of appending salt to the plain text. Why or Why not? What kind of ...
A. Sinha's user avatar
  • 397
0 votes
1 answer
1k views

Checking a salted hash against known password?

I've created a mysql dump of my users and passwords and awked them into a presentable form: Passwords: '...
user2167980's user avatar
-2 votes
2 answers
121 views

Is there a reason to salt instead of enxrypting data? [duplicate]

Is it more secure to: a) Take a password, salt it, then hash it. b) Take a password, hash it, then encrypt it(Using a symmetric algorithm with a large key)
Stoud's user avatar
  • 344
0 votes
2 answers
209 views

Can we store sensitive client information with the admins without them(admins) identifying it?

I am trying to design a pairing application for my university this valentine. How is it supposed to work, you ask?? The clients will submit preferences specifically names to the server and after some ...
yellowflash's user avatar
1 vote
3 answers
5k views

How to use password salt the right way [duplicate]

I understand the basic idea of password salts. You generate a 'random' string of data prepend this data to a user password store password and salt (salt maybe even in 'clear' form) Like in the ...
little_planet's user avatar
7 votes
1 answer
6k views

How unique should I make my SSID?

Some say that a 32-character random string is a good idea for SSID names: Treat your WiFi network name as you would a password. Make it complex and avoid using any whole words. Maximum length for an ...
Logical Fallacy's user avatar
1 vote
1 answer
347 views

Salt generation for stream cypher

Sorry if this is an elementary question but I could not find a direct answer. For end-to-end encryption of messages that wait temporarily on a server and where the sizes can vary from just a few ...
jimb's user avatar
  • 13
6 votes
1 answer
775 views

Using AES with same salt / IV - required for pattern matching algorithm

I need to securely encrypt data we are storing, but for each client I need the same plaintext to encrypt into the same cypher text. The reason for this is the data is still required for a pattern ...
moatak787's user avatar

1 2 3
4
5
8