31 reputation
2
bio website
location
age
visits member for 7 months
seen Aug 12 at 0:47

Jan
10
awarded  Supporter
Jan
10
comment Why do I need to add the original salt to each hash iteration of a password?
Thank you for your commentary, very helpful. Now, I would ask you why the code you have shared would be any better than just iterating over hash = H(hash + password)?
Jan
9
comment Why do I need to add the original salt to each hash iteration of a password?
var hash = sha512(salt + password); for (i = 0; i < 1000; i++) { hash = sha512(password + hash); } <- Why is this not good?
Jan
9
comment Why do I need to add the original salt to each hash iteration of a password?
So I understand why including the salt would not do anything beneficial but why wouldn't including the original password be beneficial? Seems that as I described above in my comments, this would ensure the only chance of collision is on the final iteration... You said most algorithms wouldn't include the salt or password in their hash iterations. What do they do instead? And why would would it be superior to using the password?
Jan
9
comment Why do I need to add the original salt to each hash iteration of a password?
@StephenTouset Why does everyone rant about "this is the best algorithm," "this is how you need to create the salt," "this is how you need to append the salt," and in your case "don't do it yourself"????? I'm only curious about the math and theory here, not what you think I should or shouldn't be doing. If you have anything useful to share in that regard, I will listen.
Jan
9
comment Why do I need to add the original salt to each hash iteration of a password?
Based on Paülo's explanation it seems that adding the original password is far better so that if a different password produces the same result in an early iteration, they would likely produce a different result next iteration. Thus, if you iterated using hash = sha512(password + hash) then the only way another password would collide is if on the last iteration, the result was equal. Seems the likelihood of collision would now be identical to doing one iteration of sha512(salt + password). Still, is it still better to iterate to make it harder on an attacker due to computational complexity?
Jan
8
awarded  Student
Jan
8
asked Why do I need to add the original salt to each hash iteration of a password?