8
votes
4answers
277 views

Using hashes as passwords

I have thought of a system for generating passwords which works as follows: Take the following items: A password, such as williamwallace. A secret 1000 digit ...
6
votes
2answers
244 views

Why do I need to add the original salt to each hash iteration of a password?

I understand it is important to hash passwords over multiple iterations to make things harder for an attacker. I have read numerous times that when processing these iterations, it is critical to hash ...
0
votes
2answers
289 views

Can a salt for a password hash be public?

For my understanding salts in password hashes are used to prevent the precompuation of plaintext$\to$hashvalues (rainbow tables). I know from different threads, it is not necessary to keep the salt ...
1
vote
1answer
88 views

Does it make sense to stretch non-keys?

I was thinking about stretching salt. Key-stretching is good against brute force guessing and assumes your system isn't compromised. Salting a one-way makes it so you have to compute * n for each ...
3
votes
1answer
2k views

Decrypting the password from SHA-512 hash value

I am currently studying AES algorithm and writing a Code using Python. I am trying to add 'Salt' into the user input password, Here is what I am doing, ...
2
votes
2answers
234 views

Could completely public passphrase hashes ever be reliably secure?

This is a hypothetical question and I only have a basic understanding of Cryptography. If one were to follow the very best cryptographic practices for storing passphrases, could it ever be possible ...
3
votes
1answer
133 views

salting with password hash to improve security?

Would something like the following improve security (against rainbow attacks, not brute force)? Assume that $P$ is a user-chosen password, and the objective is to obtain a hash $H$ for password ...
2
votes
1answer
65 views

How does the possible attack on passwords and salts mentioned in PKCS#5 v2.1 work?

From PKCS#5 v2.1, 4.1 Salt (page 6, emphasis by me), also in v2.0, RFC 2898: In password-based encryption, the party encrypting a message can gain assurance that these benefits are realized ...
4
votes
1answer
497 views

Hashing passwords with a salt - why use different salt for everyone?

Given a database where we have usernames and passwords, we want to secure users' passwords by hashing them. We should not use only username and passwords in this hash, as someone having data from ...
11
votes
2answers
530 views

Do I have to have a different salt for each password?

Should I use a different salt for each password? In my system, there are no user names, only passwords. When a user logins in, he types in one or more passwords and the server compares the results ...
4
votes
2answers
519 views

How did LinkedIn “salt” all their passwords?

First, just to make sure I understand "salting" correctly: You randomly generate a string to append to the password before hashing it, so as to increase its length and make precomputed tables much ...
5
votes
1answer
334 views

What's the reason for applying the hash twice when hashing with salt?

One of the typical approaches to computing a salted hash is this: hash(salt+hash(secret)) where hash is something like SHA-256 hash function - taking any size ...
3
votes
2answers
588 views

Passwords with same SALT. What does this mean?

If the same SALT is used for many passwords on a Linux server, in what way is that a security risk? Does the mean, that a user (which can change his own password) can calculate other users passwords? ...
13
votes
3answers
8k views

Can you help me understand what a cryptographic “salt” is?

I'm a beginner to cryptography and looking to understand in very simple terms what a cryptographic "salt" is, when I might need to use it, and why I should or should not use it. Can anyone offer me a ...
8
votes
2answers
2k views

Use of salt to hash a password

In a few implementations of hashed passwords, I have seen that the length of the random salt is chosen to be, say, 10 or "some constant". Is there any specific reason why the salt is chosen to have a ...
5
votes
5answers
259 views

In storing passwords in a database should I use a per-application salt in addition to a per-secret salt?

Assuming that the salts are sufficiently long (16 random chars) is there any advantage in using a per-application salt in addition to a per-secret salt when storing hashed passwords in a database? ...