2 ms·
Despite the other reply you got (which was my original 'lol'), no, there isn't an advantage to salting a password that is going to be encrypted with symmetrical
by drivebyacct2 14y ago
Despite the other reply you got (which was my original 'lol'), no, there isn't an advantage to salting a password that is going to be encrypted with symmetrical encryption. I mean, what would that even mean?
Encrypt("salt"+"password", key) = ENCRYPTED_DATA
Decrypt(ENCRYPTED_DATA, key) = "salt"+"password"
- teamonkey 14y agoThanks. I'm no security expert but I couldn't see how it would make a difference.
- drivebyacct2 14y agoSure, to help illustrate it further: (don't use SHA1, I'm using it to avoid a discussion of why you wouldn't manually use a salt with bcrypt) user1: SHA1("salt123"+"puppydog11") = SOME_HASH user2: SHA1("salt456"+"puppydog11") = SOME_DIFF_HASH This way, even for the same password, there are different salts, and thus different hashes. No one can run a rainbow attack unless they've generated rainbow tables for that salt (frankly, it would be possible, but useless to generate a rainbow table for a specific salt)
- dmak 14y agoIn short, it is BEST to HASH with a salt. Hash with a salt and don't use symmetrical key encryption methods.
- drivebyacct2 14y agoYup, always hash with a salt (or use an algorithm that does it for you). I added another example below for this guy. And yes, definitely don't use symmetric encryption.