4 ms·

I was more talking about bcrypt being consensus with that post. Salting slows down cracking attempts by a factor of N where N is the length of the hash; md5 an

by frisco 16y ago

I was more talking about bcrypt being consensus with that post. Salting slows down cracking attempts by a factor of N where N is the length of the hash; md5 and sha1 are so fast that you shouldn't be banking on salting to protect you in 2010. Also, you should assume that if an attacker has your database (with salts), they also have your code, which tells them exactly how the salt was applied. In that case, salting doesn't slow you down at all.

bostonvaulter2 16y ago
I think the point is that you should use bcrypt and salt at the same time.
- tptacek 16y ago
  You don't need to do anything like that; bcrypt does all this stuff for you. Don't salt bcrypt.
  - youngian 16y ago
    I think people would be a lot less confused if you said this first. Say "Don't salt bcrypt, bcrypt salts for you" and you'll have to explain yourself less.
jhchen 16y ago
But you're talking about defending against brute force attacks? Salting's strength is in defending against rainbow tables. It seems the best policy at this point is to use both as they defend against different things and are not mutually exclusive.
- tptacek 16y ago
  You don't need to do anything like that; bcrypt does all this stuff for you. Don't salt bcrypt.