Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

I'm a beginner to cryptography and looking to understand in very simple terms what a cryptographic "salt" is, when I might need to use it, and why I should or should not use it. Can anyone offer me a very simple and clear (beginner level) explanation please?

If you know of any references on the topic, those would also be useful in addition to your explanation.

share|improve this question
4  
I've edited your question to encourage explanations that should help, and the inclusion of references to help you out. I would however be inclined to take Jalaj's advice - definitely have a read around. If you can include in your questions what you're not understanding, you'll get a lot more out of the site. It is completely OK to quote the relevant parts of a reference you're not understanding and ask for clarification - in fact, that's better. The more precise you are about what you don't understand, the more we can help you :) Do feel free to edit in anything you specifically want covered. –  Ninefingers Jan 30 '12 at 14:51
add comment

4 Answers

up vote 21 down vote accepted

The reason that salts are used is that people tend to choose the same passwords, and not at all randomly. Many used passwords out there are short real words, to make it easy to remember, but this also enables for an attack.

As you may know, passwords are generally not stored in cleartext, but rather hashed. If you are unsure of the purpose of a hash-function, please read up on that first.

Now, what the attackers can do is to simply generate a list of common passwords and their corresponding hashes. Comparing the hashes that a site has stored with the table will, if common passwords are being used, reveal the passwords to the attacker.

A salt is simply added to make a common password uncommon. A salt value is generated at random and can be fairly small, the only purpose is to lower the probability that the hash-value will be found in any precalculated table. A common way to combine the salt and the password is to simply concatenate them, i.e. the stored hash value is Hash(salt||password). The common password "password1" now magically becomes, e.g., "6$dK,3password1" and is very unlikely to be found in a table.

The salt can be stored completely in the clear in the database, next to the hashed value. Once the attacker has the database and wants to find the passwords, he needs to generate the precalculated table for each salt individually, a costly operation.

Yet another way to defend against this kind of attack is to slow down the attacker. This can be achived by iterating the hash-function many times, i.e. storing Hash(Hash(Hash(Hash.....(Hash(salt||password)))...). Also, a pepper can be used, which is another random value concatenated to the password, such that the stored value is Hash(pepper||salt||password). The pepper is then not stored at all and therefore all possible values of the pepper need to be tested when trying to log in. Using 8 bits for the pepper give 256 possible values, which is very fast when the true user tries to log in. However the attack will work 256 times slower since all pepper values need to be tested for each password!

share|improve this answer
1  
+1 for the pepper! :) –  Enrichman Dec 6 '13 at 13:37
    
Didn't know about the pepper. +1. –  Joe Z. Apr 3 at 14:02
add comment

Refer to the wikipedia page on cryptographic salt. I will always suggest you to exploit internet more before posting a question here. Google search usually give you a very good reference on any matter!

share|improve this answer
    
I came here after having read the wikipedia article and found the accepted answer easier to follow. The wikipedia version is more exhaustive and probably more precise but also more peppered with specialist jargon, which makes it harder to follow for a layman. The accepted answer on the other hand provides a succint resume of the concept, even if perhaps missing some details. As a non-specialist I wouldn't know which details on the wikipedia to ignore on the first read. –  artm yesterday
add comment

It is a random number that is needed to access the encrypted data, along with the password.

If an attacker does not know the password, and is trying to guess it with a brute-force attack, then every password he tries has to be tried with each salt value.

So, for a one-bit salt (0 or 1), this makes the encryption twice as hard to break in this way. A two bit salt makes it four times as hard, a three bit salt eight times as hard, etc. You can imagine how difficult it is to crack passwords with encryption that uses a 32-bit salt!

share|improve this answer
    
No. Salt is usually assumed to be known to the attacker. In this case, past some low threshold, salt does not improve security. –  fgrieu Mar 7 '12 at 20:24
3  
"Salt is usually assumed to be known to the attacker" -> Who is assuming this? –  Mike Mar 8 '12 at 14:45
add comment

I'm going to attempt to answer a part of your question that has so far been neglected:

when I might need to use it and why I should/should not use it.

The short answer is that, as an amateur, you should not be using cryptography at a level that requires dealing with salts directly.

For instance, the bcrypt password hashing algorithm uses salts internally. But it doesn't expose that fact to developers using it — you simply pass the password to bcrypt (and optionally, a parameter that sets the "level of CPU effort" needed to generate the hash) and it returns the hash. When you need to validate if a password is correct, you pass bcrypt both the password and the previously-generated hash. It will indicate whether or not the password was the one used to generate the hash.

Do not take the advice given here and try to hash your own passwords using a salt. It is a low-level implementation detail, and if you find yourself working at a level where these sorts of things are needed, you are working at far too low a level of abstraction. Cryptography is very difficult to do correctly, and the Internet is absolutely littered with well-intentioned developers' completely insecure home-grown password hashing schemes.

share|improve this answer
    
That's good advice. But a comment like this can discourage someone from learning about cryptography. My ten cents' worth: Let this person go ahead and try to hash his own passwords, but warn against using it in an actual application –  user7691 Jul 18 '13 at 1:22
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.