Are salts useless for security if the attacker knows them?

后端 未结 7 1600
误落风尘
误落风尘 2021-02-14 11:14

Let\'s say I have a table of users set up like this:

CREATE TABLE `users` (
    `id` INTEGER PRIMARY KEY,
    `name` TEXT,
    `hashed_password` TEXT,
    `salt`         


        
7条回答
  •  面向向阳花
    2021-02-14 11:28

    Salting was introduced (or at least made popular) in UNIX /etc/passwd file, which was world-readable. It is usually assumed that the salt as well as the encrypted password is known to the cracker. The purpose of the salt is the slow-down of the cracking process (since the same password won't map to the same encrypted string); it is not a secret in itself.

提交回复
热议问题