jcoop
Reputation
Top tag
Next privilege 50 Rep.
Comment everywhere
Badges
2
Newest
Impact
~333 people reached

• 0 posts edited
• 0 helpful flags
• 1 vote cast

8 Actions

 Jan10 awarded Supporter Jan10 comment Why do I need to add the original salt to each hash iteration of a password? Thank you for your commentary, very helpful. Now, I would ask you why the code you have shared would be any better than just iterating over hash = H(hash + password)? Jan9 comment Why do I need to add the original salt to each hash iteration of a password? var hash = sha512(salt + password); for (i = 0; i < 1000; i++) { hash = sha512(password + hash); } <- Why is this not good? Jan9 comment Why do I need to add the original salt to each hash iteration of a password? So I understand why including the salt would not do anything beneficial but why wouldn't including the original password be beneficial? Seems that as I described above in my comments, this would ensure the only chance of collision is on the final iteration... You said most algorithms wouldn't include the salt or password in their hash iterations. What do they do instead? And why would would it be superior to using the password? Jan9 comment Why do I need to add the original salt to each hash iteration of a password? @StephenTouset Why does everyone rant about "this is the best algorithm," "this is how you need to create the salt," "this is how you need to append the salt," and in your case "don't do it yourself"????? I'm only curious about the math and theory here, not what you think I should or shouldn't be doing. If you have anything useful to share in that regard, I will listen. Jan9 comment Why do I need to add the original salt to each hash iteration of a password? Based on Paülo's explanation it seems that adding the original password is far better so that if a different password produces the same result in an early iteration, they would likely produce a different result next iteration. Thus, if you iterated using hash = sha512(password + hash) then the only way another password would collide is if on the last iteration, the result was equal. Seems the likelihood of collision would now be identical to doing one iteration of sha512(salt + password). Still, is it still better to iterate to make it harder on an attacker due to computational complexity? Jan8 awarded Student Jan8 asked Why do I need to add the original salt to each hash iteration of a password?