Are salts useless for security if the attacker knows them?

后端 未结 7 1567
误落风尘
误落风尘 2021-02-14 11:14

Let\'s say I have a table of users set up like this:

CREATE TABLE `users` (
    `id` INTEGER PRIMARY KEY,
    `name` TEXT,
    `hashed_password` TEXT,
    `salt`         


        
7条回答
  •  轻奢々
    轻奢々 (楼主)
    2021-02-14 11:28

    No, they're not useless.

    So long as you use a unique salt for each row, then the salt will prevent slow down an attack. The attacker will need to mount a brute force attack, rather than using rainbow tables against the password hashes.

    As mentioned in the comments, you should ensure that the salt is a sensible size.

提交回复
热议问题