Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I usually choose bcrypt when hashing as I can set the work factor to slow down the calculations of the hash. However, I have to keep a copy of the hash in order to verify it (since it includes the salt) when the same input comes around again.

Are their any A) common and B) slow hashing algorithms that do not require a salt? In other words, I don't need to preserve the output state in order to calculate the exact same hash again?

I am not looking for a more secure/unbreakable hash - just one that takes a long, long time to work out.

At this point it seems that multiple rounds of SHA-256 is my current best option.

share|improve this question
Is this for storing passwords, or something else? – Stephen Touset Nov 7 '12 at 19:52
It's for creating slow hashes of objects, using the output, and then discarding it rather than storing it. – Xeoncross Nov 7 '12 at 19:54
Is there any expectation that there will be objects smaller than 128 bytes? – Stephen Touset Nov 7 '12 at 20:45
@StephenTouset, yes. Could be as small as 12 bytes. – Xeoncross Nov 7 '12 at 23:20
Sorry, I meant to say bits (e.g., 16 bytes). 12 bytes should still be large enough that the objects' original contents can't be guessed via brute force if the site-wide salt is leaked, given that you're using a slow hashing function. – Stephen Touset Nov 7 '12 at 23:36
up vote 8 down vote accepted

You can use any common slow hash construction that takes a salt with a constant salt. This includes scrypt, bcrypt and PBKDF2.

You obviously lose the benefit of the salt. Since the purpose of a salt is preventing multi-target attacks, now an attacker can attack all hashes at the same time. I'd use at least a salt that's unique for your application, so an attacker can't attack your application at the same time as others.

Personally I'd go with scrypt, since it strengthens the most for a given derivation time limit, but you can use bcrypt or PBKDF2 if you prefer older/more popular constructions.

share|improve this answer
+1 duh, just use a constant salt. I'm not sure why I didn't think of that. – Xeoncross Nov 7 '12 at 19:51

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.