3 ms·
I was going to ask: is there actually any benefit salting a password that will be encrypted?
by teamonkey 14y ago
I was going to ask: is there actually any benefit salting a password that will be encrypted?
- DanielRibeiro 14y agoIt is really kind-of very good practice to salt passwords. We've talked a bit about this recently here on HN: http://queue.acm.org/detail.cfm?id=2254400 http://queue.acm.org/detail.cfm?id=2254400 http://news.ycombinator.com/item?id=4082746 http://news.ycombinator.com/item?id=4082746
- drivebyacct2 14y agoDespite the other reply you got (which was my original 'lol'), no, there isn't an advantage to salting a password that is going to be encrypted with symmetrical encryption. I mean, what would that even mean? Encrypt("salt"+"password", key) = ENCRYPTED_DATA Decrypt(ENCRYPTED_DATA, key) = "salt"+"password"
- teamonkey 14y agoThanks. I'm no security expert but I couldn't see how it would make a difference.
- drivebyacct2 14y agoSure, to help illustrate it further: (don't use SHA1, I'm using it to avoid a discussion of why you wouldn't manually use a salt with bcrypt) user1: SHA1("salt123"+"puppydog11") = SOME_HASH user2: SHA1("salt456"+"puppydog11") = SOME_DIFF_HASH This way, even for the same password, there are different salts, and thus different hashes. No one can run a rainbow attack unless they've generated rainbow tables for that salt (frankly, it would be possible, but useless to generate a rainbow table for a specific salt)
- dmak 14y agoIn short, it is BEST to HASH with a salt. Hash with a salt and don't use symmetrical key encryption methods.
- drivebyacct2 14y agoYup, always hash with a salt (or use an algorithm that does it for you). I added another example below for this guy. And yes, definitely don't use symmetric encryption.