6 ms·
But no, you can't re-hash with a new salt without access to the plain-text password. If you could, so could the bad guy :) Yes you can, if you believe this: ht
by bengiuliano 17y ago
But no, you can't re-hash with a new salt without access to the plain-text password. If you could, so could the bad guy :)
Yes you can, if you believe this: http://benlog.com/articles/2008/06/19/dont-hash-secrets/ http://benlog.com/articles/2008/06/19/dont-hash-secrets/
This is exactly why HMAC is more complicated than just:
hash(message+secret)
- tptacek 17y agoIt's H(k, m) that's trivial to break, not H(m, k) (where the attacker has no control over the final block of the hash). H(m, k) is also much weaker than HMAC, but in trickier ways.