Episode #125 of the Stack Overflow podcast is here. We talk Tilde Club and mechanical keyboards. Listen now

New answers tagged

0

Just filling some details of the previous answer Am I therefore supposed to include the salt in the encrypted message? For example send something like: "message = message, salt=salt"? Yes. The salt is often sent as part of the ciphertext (e.g. for OpenSSL the salt is first 8 bytes of the ciphertext for password-based ecryption). In theory you may pass ...


2

One reason is to mitigate from the Rainbow tables which is the work of Oechslin. If everybody uses the same salt, one can build a Rainbow table for cracking everybody's passwords. There are even commercial tables for sale (I'm not advertising them just providing the existence). Using the salt for key derivation and passwords simply kills the usage of ...


1

To calculate a pepperedPassword I can either just concatenate two values: Bcrypt limits the password. This means that if the password is too long (longer than 56 bytes), it will simply be truncated. If you just attach the pepper to the password, there is a high risk that this will happen. Then the pepper's security gain could even be lost without being ...


Top 50 recent answers are included