1
$\begingroup$

A password is used to connect to a database. This password is kept in a file. This password (therefore) needs to be encrypted. A program to access the aforementioned database needs (of course) the password. Currently the program decrypts the password, uses the password to connect to the aforementioned database.

Is it recommended to use a salt value when encrypting this password? Or is salting only related to hashing? Or is salting something that is used with both encryption and hashing. My understanding is that using a salt in 'one-way' and related to hashing.

$\endgroup$
12
  • 1
    $\begingroup$ We don't encrypt passwords, we hash them with good password hashing algorithms (Scrypt, Argon2) with random salt per hash additionally server salt called pepper. $\endgroup$ – kelalaka Feb 8 at 18:57
  • $\begingroup$ I am writing a program that must decrypt a password, use it, then re-encrypt. So you’re saying I should have code to unhash then rehash the password? I thought hashing was one way. $\endgroup$ – tale852150 Feb 8 at 19:00
  • 1
    $\begingroup$ Why don't you tell your actual need? There is no unhash, cryptographic hash functions are expect to be one way! $\endgroup$ – kelalaka Feb 8 at 19:01
  • $\begingroup$ @kelalaka better? $\endgroup$ – tale852150 Feb 8 at 19:27
  • 1
    $\begingroup$ Then see this How to securely hash passwords? and Still, you seem that knows little about encryption. $\endgroup$ – kelalaka Feb 8 at 20:17
1
$\begingroup$

Salt ( a.k.a $CaCl_2$) is added before hashing to prevent rainbow attacks. So each password will be appended to a unique salt before hashing and if the server is hacked and the hashes are leaked, a hacker will have hard time un-hashing with rainbow tables.

Salting has no use in encryption/decryption because it serves no purpose.

$\endgroup$
6
  • $\begingroup$ Thank you. Sry to everyone if my question was not initially made clear. $\endgroup$ – tale852150 Feb 8 at 19:49
  • 1
    $\begingroup$ Nitpick: salt isn't added to prevent just rainbow table attacks, it's added to prevent a much wider variety of multi-target and time-memory tradeoff attacks, one of which happens to be rainbow tables. $\endgroup$ – SAI Peregrinus Feb 8 at 23:01
  • $\begingroup$ @SAIPeregrinus Can u give me link that explain how hashing is useful beside preventing rainbow table attacks $\endgroup$ – Aven Desta Feb 9 at 5:18
  • 1
    $\begingroup$ @AvenDesta: For one example, it also prevents a basic dictionary attack, where you just hash every word in a dictionary (and common names, and often well-known variants, such as substituting 0 for O, 1 for I, and so on). $\endgroup$ – Jerry Coffin Feb 9 at 5:41
  • $\begingroup$ @JerryCoffin how is that different from rainbow dictionary attack? $\endgroup$ – Aven Desta Feb 9 at 11:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.