1
$\begingroup$

If a database stores password encrypted by using salt values, how are they stored?
I read somewhere, it uses timestamps. So is the timestamp also stored?
How about when a user tries to login next time, then how are timestamps considered?

$\endgroup$
  • 1
    $\begingroup$ I think this answer has what you're looking for: crypto.stackexchange.com/a/1772/17754 $\endgroup$ – sju Oct 24 '14 at 1:21
  • $\begingroup$ \$alg\$salt\$hash is a common way of storing hashes in a database, so a typical database field may look like \$apr1\$h7Fb0iS3\$24a7435b994b0bf6ea99155ac24747ec $\endgroup$ – Richie Frame Oct 24 '14 at 2:03
  • 1
    $\begingroup$ Note that "using timestamps" is very bad, unless the timestamp was an input to some function that generates the salt, then that is acceptable. A future salt should not be predictable to an attacker. $\endgroup$ – Richie Frame Oct 24 '14 at 2:04
  • $\begingroup$ think of a salt in terms of door keys; adding more "cuts" to the key makes picking the locker harder; even if the cuts aren't pinned, it still becomes harder to rake the back of the now-deeper cylinder. $\endgroup$ – dandavis May 27 '16 at 19:18
4
$\begingroup$

Salts are generally stored in the database with the password.

They shouldn't be timestamps, salts should be random values of 128 bits or more (though this may vary depending on the hashing scheme used.)

Salts improve security by making brute force attempts single-use: a password of "password" is likely going to be used many, many times. If it's hashed without a salt, then an attacker will instantly know which users used "password" as their password when they hash it. By hashing it with a per-user random salt an attacker will need to try at least one guess for each user, and hopefully several guesses. So salts help protect users who reuse passwords (there aren't that many hashing schemes) and users who choose bad passwords (attackers have to try all the bad passwords with each salt, instead of just trying them once.)

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.