Questions tagged [salt]
Salt is unique (usually random) data passed into a hash function for password storage to avoid the possible usage of rainbow tables or similar attacks. Salt will not help against dictionary or brute force attacks, as the salt is usually stored together with the hash.
41
questions
148
votes
5
answers
130k
views
What is a cryptographic "salt"?
I'm a beginner to cryptography and looking to understand in very simple terms what a cryptographic "salt" is, when I might need to use it, and why I should or should not use it.
Can I get a ...
20
votes
4
answers
14k
views
Is there a standard for OpenSSL-interoperable AES encryption?
Many AES-encrypted things (files, strings, database entries, etc.) start with "Salted__" ("U2FsdGVkX1" in base64).
I hear it's ...
11
votes
1
answer
3k
views
How to salt PBKDF2, when generating both an AES key and a HMAC key for Encrypt then MAC?
When using Encrypt-then-MAC with AES and HMAC by password, and given 128 bits of payload with the ciphertext to store a random salt, which would be more secure:
Using PBKDF2 with then entire 128 bit ...
25
votes
2
answers
3k
views
Definition of "pepper" in hash functions
I am confused about the notion of "pepper" in the context of storing hashes of users' passwords.
Definition 1: A pepper is a secret key
Looking around the Internet, for example here or here, ...
25
votes
3
answers
7k
views
Should you change salt when changing password?
Assume a password storage scheme using a computationally-expensive hash algorithm and a CSPRNG salt. User ID, salt, and hash value are stored in a table; if the table is compromised, all three ...
14
votes
2
answers
4k
views
Use of salt to hash a password
In a few implementations of hashed passwords, I have seen that the length of the random salt is chosen to be, say, 10 or "some constant". Is there any specific reason why the salt is chosen to have a ...
10
votes
3
answers
9k
views
Why hash or salt when signing? [duplicate]
EDIT: Just wondering why was this question closed as a duplicate of a question asked almost 2 years after this one...
I've seen an example of how to sign using RSA. Besides the signing itself (s = m^d ...
4
votes
1
answer
789
views
Applications in which you should/shouldn't use a salt with HKDF
rfc5869 has the following to say about the use or lack thereof of salts with HKDF:
HKDF is defined to operate with and without random salt. This is done to accommodate applications where a salt value ...
24
votes
6
answers
47k
views
PBKDF2 and salt
I want to ask some questions about the PBKDF2 function and generally about the password-based derivation functions.
Actually we use the derivation function together with the salt to provide ...
14
votes
2
answers
2k
views
Do I have to have a different salt for each password?
Should I use a different salt for each password?
In my system, there are no user names, only passwords. When a user logins in, he types in one or more passwords and the server compares the results ...
11
votes
1
answer
3k
views
Using SHA-256 with different initial hash value
FIPS 180-3 defines the initial hash value for SHA-256 as the first 32 bits of the fractional parts of the square roots of the first 8 primes 2..19. What would be the risks of using a different value (...
9
votes
4
answers
6k
views
Compare two hashes with different salt
I'm storing the salted hash of a credit card number in a database. What I'd like to be able to do is determine if two different entries in the same database correspond to the same credit card.
...
13
votes
2
answers
6k
views
If attacker knows salt and hash, how is salt effective?
Maybe I'm missing something, but if my salt and hashed/salted password are stored in the same place, how is salting any more secure than just hashing? Does this just rely on attackers not knowing how ...
11
votes
2
answers
11k
views
Should I salt an AES password at each encryption?
I saw a sample code where the same password is salted with a different value (using PBKDF2) for each encryption. That means that the salt must be stored for each encrypted message.
I don't understand ...
8
votes
1
answer
3k
views
Does salt size affect password hash security?
I use PBKDF2-SHA512 with an iteration count of 128,000 to hash my passwords. I use a CSPRNG to generate a salt per password. However, I am unsure about the ideal size of the salt. I have read a lot of ...
8
votes
1
answer
1k
views
What's the reason for applying the hash twice when hashing with salt?
One of the typical approaches to computing a salted hash is this:
hash(salt+hash(secret))
where hash is something like SHA-256 hash function - taking any size ...
5
votes
1
answer
874
views
Why not encrypt salt?
Assuming I had to distribute salt+ciphertext together over an insecure channel, isn't it better to store the salt encrypted?
By encrypted I mean with a block cipher and with key and IV derived from ...
5
votes
2
answers
1k
views
How did LinkedIn "salt" all their passwords?
First, just to make sure I understand "salting" correctly:
You randomly generate a string to append to the password before hashing it, so as to increase its length and make precomputed tables much ...
1
vote
1
answer
1k
views
Question about IV/initialization vectors
I found some code to get crypto-js to encrypt data in the browser, and with a pointer from someone on SO, it now decodes data as well.
My next question is about the use of an IV; is an IV like a salt ...
24
votes
4
answers
1k
views
Necessity of Randomness of Salts?
Given the desire to have unique salts for each user of your system, is it actually necessary to create a cryptographically-random salt for each user?
If your system already has some other unique user ...
15
votes
2
answers
9k
views
Can a salt for a password hash be public?
From my understanding, salts in password hashes are used to prevent the precomputation of plaintext→hash values (rainbow tables).
I know from different threads that it is unnecessary to keep the salt ...
13
votes
3
answers
4k
views
Salting when encrypting?
I was attending a database encryption session at a developers conference. The presenter (who was a published author on the subject) said that MS SQL Server did not support salted hashes in the ...
9
votes
4
answers
634
views
Using hashes as passwords
I have thought of a system for generating passwords which works as follows:
Take the following items:
A password, such as williamwallace.
A secret 1000 digit ...
7
votes
1
answer
3k
views
Do I need to use a CSPRNG when creating salts for user accounts?
I'm not sure about the need of using CSPRNG to create salts for each user account.
I found “Cryptographically Secure Pseudo-Random Number Generator in Qt/C++ (Cross platform)” (at StackOverflow) with ...
7
votes
1
answer
4k
views
Hashing passwords with a salt - why use different salt for everyone?
Given a database where we have usernames and passwords, we want to secure users' passwords by hashing them. We should not use only username and passwords in this hash, as someone having data from ...
6
votes
2
answers
2k
views
7-Zip Encryption: Practical Effect of Lacking Salt
A previous discussion on Cryptography StackExchange leads me to understand that 7-Zip does not use salt to derive an encryption key from password to use its AES-256 encryption; that this is a ...
6
votes
4
answers
5k
views
Salts, how does the script know what the salt is?
I am new to PHP programming and trying to grasp the idea of hashing and encryption for protecting passwords, credit card details and such. I've done a lot of reading about MD5 which I think I ...
5
votes
1
answer
1k
views
Is it true that 7zip doesn't use any salt with its KDF?
This issue claims that 7zip does not use any salt with its key derivation function: https://github.com/magnumripper/JohnTheRipper/issues/1679
If that's true, wouldn't that mean you can crack multiple ...
5
votes
1
answer
530
views
Is it safe to derive two different keys with the same password and key derivation function using two different salts?
I would like to know if the following process would harm the security of a fictional system if the persisted data would be stolen: in this system a user has a single password. The password will be ...
4
votes
1
answer
2k
views
Generating keys with HKDF from Diffie Hellman agreement
In order to generate multiple session keys from a Diffie Hellman key agreement protocol, I'm trying to use the HKDF to generate this session keys. The HKDF algorithm uses an Extraction-Expand ...
4
votes
2
answers
604
views
Could completely public passphrase hashes ever be reliably secure?
This is a hypothetical question and I only have a basic understanding of Cryptography.
If one were to follow the very best cryptographic practices for storing passphrases, could it ever be possible ...
3
votes
1
answer
339
views
What is the most secure way to check that a given masterkey is valid?
For the purposes of learning, I'm writing a small utility that allows encrypting a list of passwords using a single master key (using AES-256 and PBKDF2)
Before encrypting or decrypting any password ...
3
votes
1
answer
2k
views
Derive cipher IV and cipher Key using PBKDF2 with random salt?
It is said that cipher IV does not have to be secret and the only secret component of the encryption scheme should be a cipher key.
Question: is it safe to generate IV using PBKDF2 function, which ...
2
votes
1
answer
222
views
Salt for non-stored passwords
I have read a lot about the concept of adding a salt to a password and understand that it protects against various attacks, especially the use of rainbow tables. But this kind of attack is based on ...
2
votes
2
answers
798
views
What is the purpose of salting when integrating PBKDF2 with AES?
I'm a bit new to cryptography and I'm trying to wrap my head around PBKDF2 and AES. As a disclaimer, this is not going to be used in an actual application, I'm just testing things locally as a fun ...
2
votes
2
answers
599
views
What are the required security properties for salts?
I was recently thinking about password hashing (maybe caused by the PHC progression).
I started to think a little more about it and got stuck at this question:
What security properties do password-...
1
vote
1
answer
8k
views
Is the salt value a secret or can it be stored in cleartext just like the IV? [duplicate]
From Wikipedia I read that the IV is used to randomise the mapping of cleartext to cipher text and that the IV is usually stored (in cleartext) together with the encrypted record. (http://en.wikipedia....
1
vote
1
answer
355
views
Does it make sense to stretch non-keys?
I was thinking about stretching salt.
Key-stretching is good against brute force guessing and assumes your system isn't compromised.
Salting a one-way makes it so you have to compute * n for each ...
1
vote
3
answers
2k
views
How to securely store and validate a 4-digit PIN used on a mobile device?
I want to be able to securely (1) create and (2) validate a PIN, typed by a user primarily in a mobile app. There is no 'typical' password, although there is another 2nd factor.
The starting point ...
1
vote
2
answers
712
views
What format should a salt be when it is concatenated with the password?
Assume that, in the available environment, it is not possible to use modern password hashing functions (bcrypt, scrypt, Argon2, PBKDF2, etc.), so it is necessary to roll my own stand-in, until they ...
0
votes
2
answers
369
views
For uniterated SHA-256 of salted password, should the password precede the salt?
This is a follow-up to this question (thanks to answers from @fgrieu and @kelalaka
) about the format of a salt when hashing a salted password.
I realize this is pretty much academic, as the proposed ...