I'm looking for an authoritative reference about the history of salts in the context of hash functions. Why is the personalization string in a hash function called a "salt"? Who should be credited with introducing this technique?

So far I have found:

  • Plenty of speculative folk etymology on the Wikipedia discussion page for salt
  • The earliest academic reference to salt I can find is Password Security: A Case Study by Robert Morris & Ken Thompson, from 1979.
  • According to the source code at the UNIX Heritage Society, salted passwords seemed to be added in V7 UNIX, released in 1979 (passwd.c: V7 vs V6). The source code already refers to the technique as salt, in its use of variable names. Was this the first use of the salt technique anywhere?
  • 2
    $\begingroup$ I think the sentence from Morris and Thompson's article ; "the 12-bit random quantity (called the salt)" indicates that either they named for the article or it was internally named in the Bell Labs. They could give a reference easily if it is written somewhere, $\endgroup$
    – kelalaka
    Sep 29 at 7:40
  • $\begingroup$ I wonder this does Ken Thompson still reply e-mails? $\endgroup$
    – kelalaka
    Sep 29 at 20:33
  • 3
    $\begingroup$ Found this article which lends a level of historical imprimatur. $\endgroup$
    – Daniel S
    Oct 1 at 11:38


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.