4 ms·
Was the salt stored in the same database and also accessed?
by Nogwater 13y ago
Was the salt stored in the same database and also accessed?
- daeken 13y agoIf it's per-password, then that doesn't matter. Salts for passwords should be stored as part of the hash itself, as with bcrypt, scrypt, and others. The purpose of a salt is to defeat rainbow tables (either global, as in unsalted MD5, or site-specific in the case of a fixed salt for a whole site); nothing more.
- Nogwater 13y agoThat makes sense. Wikipedia says "The primary function of salts is to defend against dictionary attacks and pre-computed rainbow table attacks." So, I guess I was thinking that if salts were stored separately, then that would help on the dictionary angle.
- cheald 13y agoDoes it matter? The purpose of salts is to thwart rainbow tables, not to be a shared secret.