2
$\begingroup$

Basically I am trying to understand the difference between server salt and client salt. I know that the client salt is used to make encryption harder for hackers, but I can't seem to grasp the concept of a server salt. Does anyone know?

$\endgroup$
8
  • $\begingroup$ Server salt It is called pepper. See it more in Information security.se's top questions! $\endgroup$
    – kelalaka
    Sep 25, 2020 at 21:44
  • $\begingroup$ Holy, thank you so much, I was trying to figure it out for the longest time. Bless your soul $\endgroup$
    – John Chen
    Sep 25, 2020 at 21:46
  • $\begingroup$ the purpose of a server salt is to make the output of the algorithm different, even if all the other inputs are the same (salt, password, iteration count), it helps insure uniqueness $\endgroup$ Sep 25, 2020 at 23:42
  • 1
    $\begingroup$ Server salt isn't necessarily pepper. I think OP is asking about salting for pre-hashes when doing some sort of server relief. IE client hashes the password using a salt & a slow hash function, then sends the result to the server, which hashes it using a second salt and a (probably faster) hash function. So the resulting password hash is H(server_salt,H(client_salt,password)). Is this correct? $\endgroup$ Sep 27, 2020 at 2:54
  • 1
    $\begingroup$ @fgrieu these might be better. Why server side hashing is required if the client side hashing is already in place? and follow the potential duplicate link, $\endgroup$
    – kelalaka
    Sep 27, 2020 at 19:40

1 Answer 1

2
$\begingroup$

Disclaimer: The following is tentative. Before the question I did not knew about client salt.

The client salt is combined on the client side with the password. When that's used, the client no longer sends the password, but a password-equivalent obtained by hashing. Client salt is often deterministic and near-public, e.g. < DNS of the realm, converted to uppercase> | <user name> (other reference). The client salt's role is that compromise of what the client stores or sends, or what the server receives, does not leak the password (other than by exhaustive search requiring a new effort for each user).

The server salt is combined on the server side with the password (or the password-equivalent resulting from a password hash with the client salt on the client side, as above). A common practice is that server salt is random, and secret in whole of part (in which case that's pepper). The server salt's role is that compromise of what the server stores does not leak the password (or other information allowing login such as the above password-equivalent) other than by exhaustive search requiring a new effort for each user and server. Using pepper splits the information necessary to carry this attack in two: the hashed passwords+salts (typically in a database), and the pepper (typically in a config file or source fragment).

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.