1
$\begingroup$

A password is used to connect to a database. This password is kept in a file. This password (therefore) needs to be encrypted. A program to access the aforementioned database needs (of course) the password. Currently the program decrypts the password, uses the password to connect to the aforementioned database.

Is it recommended to use a salt value when encrypting this password? Or is salting only related to hashing? Or is salting something that is used with both encryption and hashing. My understanding is that using a salt in 'one-way' and related to hashing.

$\endgroup$
12
  • 1
    $\begingroup$ We don't encrypt passwords, we hash them with good password hashing algorithms (Scrypt, Argon2) with random salt per hash additionally server salt called pepper. $\endgroup$
    – kelalaka
    Feb 8, 2021 at 18:57
  • $\begingroup$ I am writing a program that must decrypt a password, use it, then re-encrypt. So you’re saying I should have code to unhash then rehash the password? I thought hashing was one way. $\endgroup$
    – tale852150
    Feb 8, 2021 at 19:00
  • 1
    $\begingroup$ Why don't you tell your actual need? There is no unhash, cryptographic hash functions are expect to be one way! $\endgroup$
    – kelalaka
    Feb 8, 2021 at 19:01
  • $\begingroup$ @kelalaka better? $\endgroup$
    – tale852150
    Feb 8, 2021 at 19:27
  • 1
    $\begingroup$ Then see this How to securely hash passwords? and Still, you seem that knows little about encryption. $\endgroup$
    – kelalaka
    Feb 8, 2021 at 20:17

1 Answer 1

1
$\begingroup$

Salt ( a.k.a $CaCl_2$) is added before hashing to prevent rainbow attacks. So each password will be appended to a unique salt before hashing and if the server is hacked and the hashes are leaked, a hacker will have hard time un-hashing with rainbow tables.

Salting has no use in encryption/decryption because it serves no purpose.

$\endgroup$
6
  • $\begingroup$ Thank you. Sry to everyone if my question was not initially made clear. $\endgroup$
    – tale852150
    Feb 8, 2021 at 19:49
  • 1
    $\begingroup$ Nitpick: salt isn't added to prevent just rainbow table attacks, it's added to prevent a much wider variety of multi-target and time-memory tradeoff attacks, one of which happens to be rainbow tables. $\endgroup$ Feb 8, 2021 at 23:01
  • $\begingroup$ @SAIPeregrinus Can u give me link that explain how hashing is useful beside preventing rainbow table attacks $\endgroup$
    – Aven Desta
    Feb 9, 2021 at 5:18
  • 1
    $\begingroup$ @AvenDesta: For one example, it also prevents a basic dictionary attack, where you just hash every word in a dictionary (and common names, and often well-known variants, such as substituting 0 for O, 1 for I, and so on). $\endgroup$ Feb 9, 2021 at 5:41
  • $\begingroup$ @JerryCoffin how is that different from rainbow dictionary attack? $\endgroup$
    – Aven Desta
    Feb 9, 2021 at 11:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.