Salt is unique (usually random) data passed into a hash function for password storage to avoid the possible usage of rainbow tables or similar attacks. Salt will not help against dictionary or brute force attacks, as the salt is usually stored together with the hash.
I am playing around with the following hashing scheme: Start with a domain string (same for all users), Allow every user to mutate it in any way defining their own custom replacement rules, Append ...
I understand how for hash functions which are vulnerable to length extension attacks (such as SHA1 and SHA2) it is safer to use a HMAC construction. What I don't understand is, how or why is ...