3 ms·
Nope, a salt is public. Its only purpose is to force you to brute force one hash at a time. It might also protect you against some attacks particular to your ha
by Coincoin 13y ago
Nope, a salt is public. Its only purpose is to force you to brute force one hash at a time. It might also protect you against some attacks particular to your hashing algorithm.
It does not slow down the brute force itself. A lonely salted one letter password is as weak as an unsalted one.
- chiph 13y agoGiven that an attacker is going to focus on high-value accounts if they can, slowing down a brute force attack on a per-hashed-value basis is pretty much your only defense. Adding complexity (like you would when defending against a rainbow table attack) adds little value when defending against a GPU-based attack that can crank out a billion hashes a minute. So what you can do is add artificial length to the password + salt combination by using a very long salt. By necessity, you'd have to use a better hashing algorithm that will have a lower chance of an attacker getting lucky with a collision, and maybe is "slower" than other hash algorithms.
- iuguy 13y agoNope. The correct way to do this is to use a password based key derivation function like scrypt[1] or pbkdf2[2]. [1] - https://www.tarsnap.com/scrypt.html https://www.tarsnap.com/scrypt.html [2] - http://en.wikipedia.org/wiki/PBKDF2 http://en.wikipedia.org/wiki/PBKDF2