65
votes
How come hash salt doesn't make a hash ineffective?
The salt is stored in plaintext next to the hash and the same salt is used when checking a password.
Its purpose is to slow down attackers who obtained a copy of the database:
They must attack each ...
45
votes
Accepted
Why do I need to store the salt for generated hashes?
The hash returned by bcrypt.hashSync is more than the hash itself, it contains all parameters needed by bcrypt. You do not need to store anything else yourself, ...
26
votes
Is there a standard for OpenSSL-interoperable AES encryption?
Since this is still open and the issue keeps coming up:
TLDR: There are lots of things in OpenSSL that implement standards including AES, but the key derivation part of ...
25
votes
Accepted
Using cryptographically random password as both the password and the salt
The whole point of a salt is to be unique to a set-password operation, so that attackers can't reuse work when they target multiple accounts (multiple users on the same server, multiple servers, or ...
16
votes
Accepted
Need for salt with IV
It sounds like you're using a password-based key derivation function that accepts an optional salt input to convert a passphrase into an encryption key, which you then use to encrypt messages with a ...
15
votes
Accepted
How come hash salt doesn't make a hash ineffective?
Direct Answers
What is the mechanism that creates the salt, juxtaposing it to the hash, and make[s] sure the password will comply to the hash+salt combination?
What creates the salt? - A random ...
13
votes
Accepted
Should we run PBKDF2 for every plaintext to be protected or should we run PBKDF2 only once?
Assume you have an IND-CCA secure cryptosystem $E$ that runs a password through a slow KDF and implicitly handles salts and random IVs, a human-chosen password $p$, and messages $m_1$ through $m_n$ to ...
12
votes
Accepted
Do I need to use a CSPRNG when creating salts for user accounts?
Answering your question
If an attacker has access to a copy of my users database table containing each salt and the related salted password, I can't understand how a CSPRNG would be more secure than ...
11
votes
Using cryptographically random password as both the password and the salt
Gilles already explained it sufficiently but using a unique salt brings another advantage: Users with identical passwords will not have identical hashes stored in the database. Unfortunately not all ...
8
votes
Accepted
Why do some key derivation functions (like PBKDF2) use a salt?
PBKDF2, like most password-based key derivation functions, has a salt input because that is often useful. Two examples:
When using PBKDF2 as a key derivation function, the salt allows to re-use the ...
7
votes
Accepted
Is there a standard for OpenSSL-interoperable AES encryption?
Using the following openssl command as a basis for this answer:
echo -n 'Hello World!' | openssl enc aes-256-cbc -e -a -salt -pbkdf2 -iter 10000
This command ...
6
votes
Accepted
Salt length for a single password
You are correct that the function of using a distinct salt for each user is to thwart any batch advantage an adversary attacking one of many targets might have gotten out of precomputed tables. If ...
6
votes
Accepted
Do very short values make a peppered hash less secure?
The assumption seems to be that the adversary wants to confirm a guess of $\mathtt{value}$ given $\mathtt{hash}=\operatorname{SHA-256}(\mathtt{value}\mathbin\|\mathtt{pepper})$, for unknown random ...
6
votes
Accepted
Why can't decrypt with OpenSSL if salt changed (for CBC and ECB)
In your command:
openssl enc -aes-256-cbc -in texte -out encrypted_texte -k password
a password is supplied, which will be used to derive the key and IV for ...
6
votes
Accepted
GUIDs as a salt
Most systems which generate Type 4 UUIDs, aka “random GUIDs” generally already use a CSPRNG to generate them. This is necessary to prevent collisions in the generated output; generating thousands ...
6
votes
Accepted
Password re-use by another person or on another service
Salt is usually stored along with the hashed password. When an attacker knows that your password is "abc123" in "pqr.com", he can try your username and password "abc123" in site "efg.com". Now "efg....
6
votes
Using cryptographically random password as both the password and the salt
I'm not sure I understand the question (mostly because I don't understand what you mean with "supply this long random password for both the message and the salt"), but if you supply the password as ...
6
votes
7-Zip Encryption: Practical Effect of Lacking Salt
The absence of salt is a severe shortcoming only where the cracker seeks access to multiple 7z files. But why would that make a difference?
If there is a password verification method and there is no ...
6
votes
Accepted
Is the output of HKDF uniformly distributed, if my input is not?
All the answers can be found in the original paper: "Cryptographic Extraction and Key Derivation: The HKDF Scheme" which is generally available.
Which properties are fullfilled, when IKM ...
5
votes
Accepted
Usage of "Salt"
How many Salt value should we use?
The idea of salts is to make the password hashes unique, so an attacker can't re-use computations from cracking one password on to another, so you really should use ...
5
votes
Accepted
Should I add randomness at the end before AES?
I want to make it harder to decrypt AES I send.
Fundamentally, the thing you are trying to do is completely unnecessary. If AES does ever become broken, the scenarios in which this makes any ...
5
votes
How do you get the original salt after it's been hashed to the user's password in the database?
Did you read what you found? Quote: Save both the salt and the hash in the user's database record. and ...
5
votes
What is best practise for salting and multiple-hashing of passwords?
Current best practice does include bcrypt, which is the same as PHP's built in password_hash() function. Future best practice will probably be Argon2.
Other widely used secure KDF options include ...
5
votes
Accepted
Salt passwords with the username?
However, since usernames are unique [...]
But the same user is supposed to get a fresh salt when they change their password. Salts are not supposed to be bound to usernames as you suggest; they're ...
5
votes
Accepted
Can't salt be easily removed from hashed password if access to the database was obtained?
Also most of the reputable websites who care about security will place
a limit on how many times you can enter credentials so I don't
understand how one could use brute force algorithm to crack ...
5
votes
Two salts, One password
No, if it is possible then it defeats the purpose of using salts. For example, one can build one rainbow table, mapping each possible password together with a fixed salt value to a hash value. Then ...
5
votes
Accepted
ChaCha20-Poly1305: Can my salt/pass for a KDF also be the nonce?
If you have a PSK then you don't need a password. You can just derive new session keys from the PSK, e.g. using a salt within HKDF. It is also possible to derive a key and IV if you're already using a ...
5
votes
Accepted
How to securely store and validate a 4-digit PIN used on a mobile device?
PIN check is bound to rely on trusted device or security by obscurity.
If a 4-digit Personal Identification Number is stored and validated in an device (possibly composite, like combination of server ...
5
votes
Accepted
Random salt and PBKDF2 key
Yes, generally the salt is prefixed to the ciphertext.
In principle you always generate a new key for each salt, so you might not need the IV. I would however use the output of PBKDF2 to create a ...
5
votes
Password Hashing based on Common Passwords
There are two things the attacker needs to do to recover a password:
Calculate the hash for some input
Compare a calculated hash against the stored hash for some user
Importantly, the hashing ...
Only top scored, non community-wiki answers of a minimum length are eligible
Related Tags
salt × 224hash × 85
passwords × 54
password-hashing × 41
encryption × 35
pbkdf-2 × 34
aes × 33
key-derivation × 32
initialization-vector × 13
authentication × 9
sha-256 × 9
password-based-encryption × 9
hkdf × 9
argon2 × 8
hmac × 7
nonce × 7
bcrypt × 7
collision-resistance × 6
md5 × 6
scrypt × 6
database × 6
rsa × 5
signature × 5
random-number-generator × 5
implementation × 4