Questions tagged [salt]

Salt is unique (usually random) data passed into a hash function for password storage to avoid the possible usage of rainbow tables or similar attacks. Salt will not help against dictionary or brute force attacks, as the salt is usually stored together with the hash.

Filter by
Sorted by
Tagged with
148 votes
5 answers
130k views

What is a cryptographic "salt"?

I'm a beginner to cryptography and looking to understand in very simple terms what a cryptographic "salt" is, when I might need to use it, and why I should or should not use it. Can I get a ...
Bhavik Ambani's user avatar
20 votes
4 answers
14k views

Is there a standard for OpenSSL-interoperable AES encryption?

Many AES-encrypted things (files, strings, database entries, etc.) start with "Salted__" ("U2FsdGVkX1" in base64). I hear it's ...
David Cary's user avatar
  • 5,664
11 votes
1 answer
3k views

How to salt PBKDF2, when generating both an AES key and a HMAC key for Encrypt then MAC?

When using Encrypt-then-MAC with AES and HMAC by password, and given 128 bits of payload with the ciphertext to store a random salt, which would be more secure: Using PBKDF2 with then entire 128 bit ...
jbtule's user avatar
  • 278
25 votes
2 answers
3k views

Definition of "pepper" in hash functions

I am confused about the notion of "pepper" in the context of storing hashes of users' passwords. Definition 1: A pepper is a secret key Looking around the Internet, for example here or here, ...
Malte Skoruppa's user avatar
25 votes
3 answers
7k views

Should you change salt when changing password?

Assume a password storage scheme using a computationally-expensive hash algorithm and a CSPRNG salt. User ID, salt, and hash value are stored in a table; if the table is compromised, all three ...
Bob Brown's user avatar
  • 353
14 votes
2 answers
4k views

Use of salt to hash a password

In a few implementations of hashed passwords, I have seen that the length of the random salt is chosen to be, say, 10 or "some constant". Is there any specific reason why the salt is chosen to have a ...
hrishikeshp19's user avatar
10 votes
3 answers
9k views

Why hash or salt when signing? [duplicate]

EDIT: Just wondering why was this question closed as a duplicate of a question asked almost 2 years after this one... I've seen an example of how to sign using RSA. Besides the signing itself (s = m^d ...
ispiro's user avatar
  • 2,005
4 votes
1 answer
789 views

Applications in which you should/shouldn't use a salt with HKDF

rfc5869 has the following to say about the use or lack thereof of salts with HKDF: HKDF is defined to operate with and without random salt. This is done to accommodate applications where a salt value ...
nohatsatthetable's user avatar
24 votes
6 answers
47k views

PBKDF2 and salt

I want to ask some questions about the PBKDF2 function and generally about the password-based derivation functions. Actually we use the derivation function together with the salt to provide ...
thrylos_7's user avatar
  • 341
14 votes
2 answers
2k views

Do I have to have a different salt for each password?

Should I use a different salt for each password? In my system, there are no user names, only passwords. When a user logins in, he types in one or more passwords and the server compares the results ...
Eyal's user avatar
  • 405
11 votes
1 answer
3k views

Using SHA-256 with different initial hash value

FIPS 180-3 defines the initial hash value for SHA-256 as the first 32 bits of the fractional parts of the square roots of the first 8 primes 2..19. What would be the risks of using a different value (...
ericball's user avatar
  • 413
9 votes
4 answers
6k views

Compare two hashes with different salt

I'm storing the salted hash of a credit card number in a database. What I'd like to be able to do is determine if two different entries in the same database correspond to the same credit card. ...
Oliver Dain's user avatar
13 votes
2 answers
6k views

If attacker knows salt and hash, how is salt effective?

Maybe I'm missing something, but if my salt and hashed/salted password are stored in the same place, how is salting any more secure than just hashing? Does this just rely on attackers not knowing how ...
Clint Powell's user avatar
11 votes
2 answers
11k views

Should I salt an AES password at each encryption?

I saw a sample code where the same password is salted with a different value (using PBKDF2) for each encryption. That means that the salt must be stored for each encrypted message. I don't understand ...
Benoit's user avatar
  • 113
8 votes
1 answer
3k views

Does salt size affect password hash security?

I use PBKDF2-SHA512 with an iteration count of 128,000 to hash my passwords. I use a CSPRNG to generate a salt per password. However, I am unsure about the ideal size of the salt. I have read a lot of ...
Pascal Bergeron's user avatar
8 votes
1 answer
1k views

What's the reason for applying the hash twice when hashing with salt?

One of the typical approaches to computing a salted hash is this: hash(salt+hash(secret)) where hash is something like SHA-256 hash function - taking any size ...
sharptooth's user avatar
5 votes
1 answer
874 views

Why not encrypt salt?

Assuming I had to distribute salt+ciphertext together over an insecure channel, isn't it better to store the salt encrypted? By encrypted I mean with a block cipher and with key and IV derived from ...
file-encrypter-noob's user avatar
5 votes
2 answers
1k views

How did LinkedIn "salt" all their passwords?

First, just to make sure I understand "salting" correctly: You randomly generate a string to append to the password before hashing it, so as to increase its length and make precomputed tables much ...
user541686's user avatar
  • 1,349
1 vote
1 answer
1k views

Question about IV/initialization vectors

I found some code to get crypto-js to encrypt data in the browser, and with a pointer from someone on SO, it now decodes data as well. My next question is about the use of an IV; is an IV like a salt ...
Lucas Krupinski's user avatar
24 votes
4 answers
1k views

Necessity of Randomness of Salts?

Given the desire to have unique salts for each user of your system, is it actually necessary to create a cryptographically-random salt for each user? If your system already has some other unique user ...
GWLlosa's user avatar
  • 659
15 votes
2 answers
9k views

Can a salt for a password hash be public?

From my understanding, salts in password hashes are used to prevent the precomputation of plaintext→hash values (rainbow tables). I know from different threads that it is unnecessary to keep the salt ...
Chris's user avatar
  • 325
13 votes
3 answers
4k views

Salting when encrypting?

I was attending a database encryption session at a developers conference. The presenter (who was a published author on the subject) said that MS SQL Server did not support salted hashes in the ...
Jim McKeeth's user avatar
9 votes
4 answers
634 views

Using hashes as passwords

I have thought of a system for generating passwords which works as follows: Take the following items: A password, such as williamwallace. A secret 1000 digit ...
daviewales's user avatar
7 votes
1 answer
3k views

Do I need to use a CSPRNG when creating salts for user accounts?

I'm not sure about the need of using CSPRNG to create salts for each user account. I found “Cryptographically Secure Pseudo-Random Number Generator in Qt/C++ (Cross platform)” (at StackOverflow) with ...
incompleteness's user avatar
7 votes
1 answer
4k views

Hashing passwords with a salt - why use different salt for everyone?

Given a database where we have usernames and passwords, we want to secure users' passwords by hashing them. We should not use only username and passwords in this hash, as someone having data from ...
ThePiachu's user avatar
  • 1,679
6 votes
2 answers
2k views

7-Zip Encryption: Practical Effect of Lacking Salt

A previous discussion on Cryptography StackExchange leads me to understand that 7-Zip does not use salt to derive an encryption key from password to use its AES-256 encryption; that this is a ...
Ray Woodcock's user avatar
6 votes
4 answers
5k views

Salts, how does the script know what the salt is?

I am new to PHP programming and trying to grasp the idea of hashing and encryption for protecting passwords, credit card details and such. I've done a lot of reading about MD5 which I think I ...
Sam's user avatar
  • 161
5 votes
1 answer
1k views

Is it true that 7zip doesn't use any salt with its KDF?

This issue claims that 7zip does not use any salt with its key derivation function: https://github.com/magnumripper/JohnTheRipper/issues/1679 If that's true, wouldn't that mean you can crack multiple ...
ItM's user avatar
  • 207
5 votes
1 answer
530 views

Is it safe to derive two different keys with the same password and key derivation function using two different salts?

I would like to know if the following process would harm the security of a fictional system if the persisted data would be stolen: in this system a user has a single password. The password will be ...
Marco's user avatar
  • 53
4 votes
1 answer
2k views

Generating keys with HKDF from Diffie Hellman agreement

In order to generate multiple session keys from a Diffie Hellman key agreement protocol, I'm trying to use the HKDF to generate this session keys. The HKDF algorithm uses an Extraction-Expand ...
user8523's user avatar
4 votes
2 answers
604 views

Could completely public passphrase hashes ever be reliably secure?

This is a hypothetical question and I only have a basic understanding of Cryptography. If one were to follow the very best cryptographic practices for storing passphrases, could it ever be possible ...
Robin Winslow's user avatar
3 votes
1 answer
339 views

What is the most secure way to check that a given masterkey is valid?

For the purposes of learning, I'm writing a small utility that allows encrypting a list of passwords using a single master key (using AES-256 and PBKDF2) Before encrypting or decrypting any password ...
tigrou's user avatar
  • 155
3 votes
1 answer
2k views

Derive cipher IV and cipher Key using PBKDF2 with random salt?

It is said that cipher IV does not have to be secret and the only secret component of the encryption scheme should be a cipher key. Question: is it safe to generate IV using PBKDF2 function, which ...
Acetylator's user avatar
2 votes
1 answer
222 views

Salt for non-stored passwords

I have read a lot about the concept of adding a salt to a password and understand that it protects against various attacks, especially the use of rainbow tables. But this kind of attack is based on ...
User01638's user avatar
2 votes
2 answers
798 views

What is the purpose of salting when integrating PBKDF2 with AES?

I'm a bit new to cryptography and I'm trying to wrap my head around PBKDF2 and AES. As a disclaimer, this is not going to be used in an actual application, I'm just testing things locally as a fun ...
swedishfished's user avatar
2 votes
2 answers
599 views

What are the required security properties for salts?

I was recently thinking about password hashing (maybe caused by the PHC progression). I started to think a little more about it and got stuck at this question: What security properties do password-...
SEJPM's user avatar
  • 45.9k
1 vote
1 answer
8k views

Is the salt value a secret or can it be stored in cleartext just like the IV? [duplicate]

From Wikipedia I read that the IV is used to randomise the mapping of cleartext to cipher text and that the IV is usually stored (in cleartext) together with the encrypted record. (http://en.wikipedia....
Krumelur's user avatar
  • 1,175
1 vote
1 answer
355 views

Does it make sense to stretch non-keys?

I was thinking about stretching salt. Key-stretching is good against brute force guessing and assumes your system isn't compromised. Salting a one-way makes it so you have to compute * n for each ...
Andrew Hoffman's user avatar
1 vote
3 answers
2k views

How to securely store and validate a 4-digit PIN used on a mobile device?

I want to be able to securely (1) create and (2) validate a PIN, typed by a user primarily in a mobile app. There is no 'typical' password, although there is another 2nd factor. The starting point ...
user2530062's user avatar
1 vote
2 answers
712 views

What format should a salt be when it is concatenated with the password?

Assume that, in the available environment, it is not possible to use modern password hashing functions (bcrypt, scrypt, Argon2, PBKDF2, etc.), so it is necessary to roll my own stand-in, until they ...
rtillery's user avatar
  • 115
0 votes
2 answers
369 views

For uniterated SHA-256 of salted password, should the password precede the salt?

This is a follow-up to this question (thanks to answers from @fgrieu and @kelalaka ) about the format of a salt when hashing a salted password. I realize this is pretty much academic, as the proposed ...
rtillery's user avatar
  • 115