I'm not a cryptography expert. In this video, and in some other places in the web, I saw hash salts are being called "random".

But if the salt is created only once and then reused each time anew, that is, added before the password as H({S,P}) each time anew with its same value,

how come it seems to me to be commonly named "random"?

The only thing seems random to me is the creation process. Is it indeed the case?


When we hash passwords with a salt, a new salt is selected at random for each new password. So different passwords have different random salts. However, the same salt is reused for future authentication attempts.

Typically, when the authentication system is supplied with the user id and password, it fetches the salted hash for the required user, hashes the provided password with the old salt and checks against the stored hash.

So yes, only the creation process of the salt is random.

  • 1
    $\begingroup$ Also the only thing that can be random about a fixed value (as opposed to a continuous stream) is its creation process. $\endgroup$ – SAI Peregrinus Sep 25 '17 at 5:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.