Skip to main content
Cryptography

Return to Answer

... or different softwares, too.
Source Link
Paŭlo Ebermann
Paŭlo Ebermann
  • 22.8k
  • 7
  • 81
  • 118

The role of the salt is to be as unique as possible: two distinct instances of a stored password (for two distinct users, or two successive passwords for the same user) shall use distinct salt values. Preferably, this uniqueness should be worldwide: it is best if there is no salt collision even across two installations of the same software (or different softwares using the same password hashing algorithm).

The penalty for a salt collision is that the two passwords which use the same salt value could be attacked for the same price as attacking one password. Here, I am talking about dictionary attacks: trying potential passwords until a match is found. The smart attacker will try to attack several passwords simultaneously, or use precomputed tables, to lower the attack average cost; salt uniqueness prevents that.

Worldwide uniqueness is hard to guarantee, but with random salts (with a good PRNG) of sufficient length, the risks of collision can be made arbitrary low. With 10-byte salts, risks of having even one collision are negligible until billions of passwords are stored.

Apart from uniqueness, salts have no constraint, and trigger no security issue by their length or structure. Note that salts are not secret (if they were, we would call them keys, not salts): a salt is normally stored along the hashed password, and it is assumed that the attacker knows it.

The role of the salt is to be as unique as possible: two distinct instances of a stored password (for two distinct users, or two successive passwords for the same user) shall use distinct salt values. Preferably, this uniqueness should be worldwide: it is best if there is no salt collision even across two installations of the same software.

The penalty for a salt collision is that the two passwords which use the same salt value could be attacked for the same price as attacking one password. Here, I am talking about dictionary attacks: trying potential passwords until a match is found. The smart attacker will try to attack several passwords simultaneously, or use precomputed tables, to lower the attack average cost; salt uniqueness prevents that.

Worldwide uniqueness is hard to guarantee, but with random salts (with a good PRNG) of sufficient length, the risks of collision can be made arbitrary low. With 10-byte salts, risks of having even one collision are negligible until billions of passwords are stored.

Apart from uniqueness, salts have no constraint, and trigger no security issue by their length or structure. Note that salts are not secret (if they were, we would call them keys, not salts): a salt is normally stored along the hashed password, and it is assumed that the attacker knows it.

The role of the salt is to be as unique as possible: two distinct instances of a stored password (for two distinct users, or two successive passwords for the same user) shall use distinct salt values. Preferably, this uniqueness should be worldwide: it is best if there is no salt collision even across two installations of the same software (or different softwares using the same password hashing algorithm).

The penalty for a salt collision is that the two passwords which use the same salt value could be attacked for the same price as attacking one password. Here, I am talking about dictionary attacks: trying potential passwords until a match is found. The smart attacker will try to attack several passwords simultaneously, or use precomputed tables, to lower the attack average cost; salt uniqueness prevents that.

Worldwide uniqueness is hard to guarantee, but with random salts (with a good PRNG) of sufficient length, the risks of collision can be made arbitrary low. With 10-byte salts, risks of having even one collision are negligible until billions of passwords are stored.

Apart from uniqueness, salts have no constraint, and trigger no security issue by their length or structure. Note that salts are not secret (if they were, we would call them keys, not salts): a salt is normally stored along the hashed password, and it is assumed that the attacker knows it.

Source Link
Thomas Pornin
Thomas Pornin
  • 87.8k
  • 16
  • 246
  • 314

The role of the salt is to be as unique as possible: two distinct instances of a stored password (for two distinct users, or two successive passwords for the same user) shall use distinct salt values. Preferably, this uniqueness should be worldwide: it is best if there is no salt collision even across two installations of the same software.

The penalty for a salt collision is that the two passwords which use the same salt value could be attacked for the same price as attacking one password. Here, I am talking about dictionary attacks: trying potential passwords until a match is found. The smart attacker will try to attack several passwords simultaneously, or use precomputed tables, to lower the attack average cost; salt uniqueness prevents that.

Worldwide uniqueness is hard to guarantee, but with random salts (with a good PRNG) of sufficient length, the risks of collision can be made arbitrary low. With 10-byte salts, risks of having even one collision are negligible until billions of passwords are stored.

Apart from uniqueness, salts have no constraint, and trigger no security issue by their length or structure. Note that salts are not secret (if they were, we would call them keys, not salts): a salt is normally stored along the hashed password, and it is assumed that the attacker knows it.