1
$\begingroup$

I was wondering if using a salt with a hash is more effective than hashing and encrypting your hash.

$\endgroup$
  • 2
    $\begingroup$ More effective for what use-case? Password hashing? $\endgroup$ – Stephen Touset Feb 26 '16 at 23:04
4
$\begingroup$

Yes. They provide different things.

The reason you hash a password is so you compare it later on without ever exposing the plaintext. A salt is used to make a large collection of hashes harder to bruteforce.

Encrypting a hash does nothing to make the hash harder to bruteforce. If you're compromised to the point your hashes are leaked, there is a good chance the attacker will also be able to figure out the encryption method and the key.

| improve this answer | |
$\endgroup$
  • 1
    $\begingroup$ Saying a salt makes a hash harder to brute force is misleading. It does not make brute forcing a particular hash harder, but it can make brute forcing a corpus of hashes harder, by tying each guess to a specific hash rather than to the corpus as a whole. Encrypting hashes does in fact make brute forcing much more difficult as long as the key is kept secret — the attacker must now brute force the key as well as the password. $\endgroup$ – Stephen Touset Feb 26 '16 at 23:07
  • $\begingroup$ @StephenTouset for sure. I misspoke. $\endgroup$ – d1str0 Feb 26 '16 at 23:08
  • $\begingroup$ "...able to figure out the encryption method and the key" You may want to edit your answer instead of just acknowledging Stephen (and, hopefully, me). $\endgroup$ – Maarten Bodewes Feb 27 '16 at 11:52
  • $\begingroup$ Let's just say that your server had an SQL in the passwords database. At that point, doesn't encryption do about the same thing as a salt, or even potentially more? $\endgroup$ – Stoud Feb 27 '16 at 17:13
  • $\begingroup$ @MaartenBodewes edited. $\endgroup$ – d1str0 Feb 27 '16 at 19:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.