4 ms·
The inclusion of a salt only protects against precomputed hashes. It makes almost no difference to how many millions of hashes one can perform per second.
by biot 11y ago
The inclusion of a salt only protects against precomputed hashes. It makes almost no difference to how many millions of hashes one can perform per second.
- Ded7xSEoPKYNsDd 11y agoI think the idea is not to publicize the salt. The proof still works (after both user name and salt are publicly known), but a dictionary attack with all twitter handles won't work.
- zaroth 11y agoExactly. If you publish just the digest of "HMAC(salt,handle)" and want to find a new salt in order to fill in a different twitter handle but with the same digest, this is called a pre-image attack -- finding a message with a specific hash value, with a time complexity of 2^n.