2 ms·
Personally, I was curious. Why doesn't a distinction need to be made between a random salt and the same salt used every time? Don't they have dramatically diffe
by durin42 17y ago
Personally, I was curious. Why doesn't a distinction need to be made between a random salt and the same salt used every time? Don't they have dramatically different results in terms of security?
And yeah, his choice of MD5 is an abomination, but that wasn't something that I thought was even nonobvious.
- amalcon 17y agoIf you're trying to crack a specific password, there's no difference: you still need to hash (password + salt) for all passwords. If you're trying to crack all passwords out of a database, however, you need to hash (password + salt) for all salt. In the latter case, increasing the number of distinct salts in use increases the time-complexity of cracking, without doing anything to the time-complexity of authentication (though requiring O(n) space).