I was wondering if using a salt with a hash is more effective than hashing and encrypting your hash.
1
-
2$\begingroup$ More effective for what use-case? Password hashing? $\endgroup$– Stephen TousetFeb 26, 2016 at 23:04
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
5
Yes. They provide different things.
The reason you hash a password is so you compare it later on without ever exposing the plaintext. A salt is used to make a large collection of hashes harder to bruteforce.
Encrypting a hash does nothing to make the hash harder to bruteforce. If you're compromised to the point your hashes are leaked, there is a good chance the attacker will also be able to figure out the encryption method and the key.
-
1$\begingroup$ Saying a salt makes a hash harder to brute force is misleading. It does not make brute forcing a particular hash harder, but it can make brute forcing a corpus of hashes harder, by tying each guess to a specific hash rather than to the corpus as a whole. Encrypting hashes does in fact make brute forcing much more difficult as long as the key is kept secret — the attacker must now brute force the key as well as the password. $\endgroup$ Feb 26, 2016 at 23:07
-
-
$\begingroup$ "...able to figure out the encryption method and the key" You may want to edit your answer instead of just acknowledging Stephen (and, hopefully, me). $\endgroup$– Maarten Bodewes ♦Feb 27, 2016 at 11:52
-
$\begingroup$ Let's just say that your server had an SQL in the passwords database. At that point, doesn't encryption do about the same thing as a salt, or even potentially more? $\endgroup$– StoudFeb 27, 2016 at 17:13
-