1
$\begingroup$

I was wondering if using a salt with a hash is more effective than hashing and encrypting your hash.

$\endgroup$
1
  • 2
    $\begingroup$ More effective for what use-case? Password hashing? $\endgroup$ Feb 26, 2016 at 23:04

1 Answer 1

4
$\begingroup$

Yes. They provide different things.

The reason you hash a password is so you compare it later on without ever exposing the plaintext. A salt is used to make a large collection of hashes harder to bruteforce.

Encrypting a hash does nothing to make the hash harder to bruteforce. If you're compromised to the point your hashes are leaked, there is a good chance the attacker will also be able to figure out the encryption method and the key.

$\endgroup$
5
  • 1
    $\begingroup$ Saying a salt makes a hash harder to brute force is misleading. It does not make brute forcing a particular hash harder, but it can make brute forcing a corpus of hashes harder, by tying each guess to a specific hash rather than to the corpus as a whole. Encrypting hashes does in fact make brute forcing much more difficult as long as the key is kept secret — the attacker must now brute force the key as well as the password. $\endgroup$ Feb 26, 2016 at 23:07
  • $\begingroup$ @StephenTouset for sure. I misspoke. $\endgroup$
    – d1str0
    Feb 26, 2016 at 23:08
  • $\begingroup$ "...able to figure out the encryption method and the key" You may want to edit your answer instead of just acknowledging Stephen (and, hopefully, me). $\endgroup$
    – Maarten Bodewes
    Feb 27, 2016 at 11:52
  • $\begingroup$ Let's just say that your server had an SQL in the passwords database. At that point, doesn't encryption do about the same thing as a salt, or even potentially more? $\endgroup$
    – Stoud
    Feb 27, 2016 at 17:13
  • $\begingroup$ @MaartenBodewes edited. $\endgroup$
    – d1str0
    Feb 27, 2016 at 19:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.