3 ms·

What do you mean by "my salting algorithm is very strong"?

• Ixiaus 16y ago
  Instead of just concatenating a salt to the password string, I use a dispersion method. I first concat the salt to the beginning of the password and SHA512 that. I then have a globally configured list in my app (it's different for every app I produce) that defines at which index, in the hashed salt+password digest, chunks of the (same) salt are sliced and interspersed. Given the same list of indexes, I can then "find" the salt of a stored password hash and run a given plain text password through that algorithm. But, as has been stated, that effort is completely null if the SHA512 algorithm is fast and brute-forcing it only takes a handful of rented GPU instances... [EDIT] Now that I think about it, if the Gawker attack were to happen to me, then the attackers would also have the source code and can get the salt dispersion list... So this is, in hindsight, kind of pointless.
  • ErrantX 16y ago
    Poor mans solution here is to iterate your fast hash a number of times. This is essentially what bcrypt does for you anyway (in a really crude sense).