Should you hash the salt on its own ? Is that possible?
for example being password with salt appended at the end hash(pass || salt) and hash(salt) in a password file?
1 Answer
$\begingroup$
$\endgroup$
Salt should remain in the plain form. There are 2 reasons for this:
- Salt is not secret. If the attacker knows salt, it will not give any advantage. The purpose of salt is to prevent usage of rainbow tables. If every password hash uses different salt, then rainbow table makes no sense.
- To check if a password candidate is correct, we need to repeat exactly the same hashing steps as for the correct password. Means, we need salt in the plain form.
