3 ms·
I'm thinking that a salt could be retro fitted by changing the check from: sha1($password); to sha1(sha1($password) . $salt); and you could update the databas
by rythie 18y ago
I'm thinking that a salt could be retro fitted by changing the check from:
sha1($password);
to
sha1(sha1($password) . $salt);
and you could update the database for that easily.
- umbrae 18y agoIsn't there some evidence that hashing a hash is cryptographically weaker?
- rythie 17y agoYes it is probably slightly weaker. It would be weaker if there are collisions in the 1-16 character password space for sha1 (assuming a 16 character limit on the password). My point was that if you already have a lot hashed passwords then you need a way to transition to salted ones and this was a method to do that.