3 ms·
I think what you actually want is: PASS column = HMAC(plaintext_pass, salt) I might be wrong? As I understand it there are issues with MD5(MD5(password) + sal
by jf 17y ago
I think what you actually want is:
PASS column = HMAC(plaintext_pass, salt)
I might be wrong? As I understand it there are issues with MD5(MD5(password) + salt) that HMAC avoids. I'm still not 100% sure I understand the difference, but I think that is what the wikipedia article on HMAC is saying: http://en.wikipedia.org/wiki/HMAC#Design_principles http://en.wikipedia.org/wiki/HMAC#Design_principles
- judofyr 17y agoHMAC is mostly useful when you want to verify that some text hasn't been altered. The client sends message + HMAC(message, secret) and then the server (which also knows the secret) can verify that no-one has changed the message. Dunno if it helps anything when it comes to salting. Anyone else who knows?