1
$\begingroup$

I am currently developing the back end of a website for one my projects and needed to store passwords. I knew that I needed to store passwords with salt, and my initial approach was to just generate the salt and append it to the password. However, to check that I wasn't being stupid I looked it up and saw a multitude of functions built into Node.js (the framework I'm using) to incorporate salt into hashing. Is there any reason I can't just append the salt to the password and if not can you please explain because I don't won't to just blindly do something? From my knowledge of hashing and salt, I see no reason why I couldn't do this.

$\endgroup$
1
  • 2
    $\begingroup$ Other than salts, Passwords should be hashed using slow hashing functions instead of regular cryptographic hashing functions. There are ready made functions which do the salting & also slow hash - best to use those instead of reinventing the wheel. $\endgroup$
    – user93353
    Commented Dec 13, 2022 at 7:55

1 Answer 1

4
$\begingroup$

There is much to be said against using a "normal" hash function for password hashing. The cracking would be accelerated. If you have a good reason to do so anyway, then appending the salt is probably not a relevant vulnerability.

If you use a password hashing algorithm, appending can cause problems. For example, Bcrypt simply cuts off the input (the password) over 56 bytes, so the salt could be truncated without you realizing it.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.