4 ms·
Isn't salting a canonical way to vary the output for the same input, thus reducing feasibility of precomputed attacks like rainbow tables? What are the benefits
by adambyrtek 14y ago
Isn't salting a canonical way to vary the output for the same input, thus reducing feasibility of precomputed attacks like rainbow tables? What are the benefits of some extra mangling, besides security through obscurity?
- tedunangst 14y agoThe point is that computers are really fast now. There's no need to precompute anything, just crack hashes on the fly. The extra mangling slows things down.
- EricDeb 14y agoIf an attacker gets access to a database of user names/hashes, a salt prevents him from simply checking the hashes against a precomputed list because each hash is totally unique. The attacker would have to recompute all hashes for each user using their individual salt. At least that's what I remember from Computer Security ha
- astrodust 14y agoSalting means that you must crack each key individually. It slows things down marginally in the long-run and at least precludes someone form using Google as your rainbow table. Have you ever tried searching for MD5 hashes of things like 'password' or 'pass123'? It's terrifying.
- adambyrtek 14y agoLooks like it wasn't clear that my question was rhetorical. My point was that some secret mangling on top of a standard hashing algorithm doesn't offer more protection than salting.