4 ms·
Basic version: The salt prevents an attacker from being able to pre-compute a mapping from password <-> hash value. It's most effective when it changes per-pass
by dguido 16y ago
Basic version: The salt prevents an attacker from being able to pre-compute a mapping from password <-> hash value. It's most effective when it changes per-password and it doesn't matter if it's public.
http://en.wikipedia.org/wiki/Salt_(cryptography) http://en.wikipedia.org/wiki/Salt_(cryptography)
- nitrogen 16y agoTo make it even more obvious, it's to prevent this (I haven't done SQL in a long while so this may be broken): SELECT username FROM users WHERE password=HASH('secret'); I've seen systems where that statement will give a list of all usernames with the password "secret".
- rmc 16y agoIf you use a salt you could still do this 'attack. SELECT username FROM users WHERE password = HASH(salt||'secret'); This is academic because you already know the password ('secret'). Salts make rainbow tables (essentially precomputed hash values of (say) all english words) hard and infesiable.