Should the Salt for a password Hash be “hashed” also?

后端 未结 5 2009
一整个雨季
一整个雨季 2021-01-05 17:29

This I think may be a silly question, but I have become quite confused on what I should do here for the best.

When salting a password hash, should the salt also be h

5条回答
  •  借酒劲吻你
    2021-01-05 18:12

    As the salt needs to be saved along with the hash (or at least must be retrievable along with the hash), an attacker could possibly get both the salt and the hashed password. In some of my applications, I've stored the salt encrypted in the database (with a key known only to the application). My reasoning was that storing the salt unencrypted along with the hashed password would make it easier to crack the passwords, as a hacker that would be able to retrieve the password table (and would know or make an assumption about the hash algorithm) would be able to find matches between hashes of well known words (dictionary attack) by hashing each word in the dictionary and then salting with the salt he also has access to. If the salt would be encrypted, such an attack wouldn't be possible unless he would also have access to the encryption key known to the application.

    (If anybody sees a fault in this logic, please comment.)

提交回复
热议问题