So I've been reading about salt, and am confused about why the length is so critical. From my understanding salt is used for protection against pre-computed attacks.
Say I have a single password that is hash with salt length n
. Suppose this hash and salt is accessible to the attacker. My questions are as follow:
If the
n
is too short, is the problem that a pre-computed rainbow table may already exist?If
n
is long enough that a pre-computed rainbow table doesn't exist, what function does a longer salt serve? A brute force attack would simply add then
length salt to each hash it's generating. 50 bitn
, 500 bitn
. No difference, because the salt is known and simply added to all the brute force password values being hashed.
So to summarize, when trying to crack a single salted password hash, as long as n
is long enough that a rainbow table doesn't exist, then the salt length n
adds no security to the hashed password. Is this true?