link:
Cryptography Salt
Date and Time: 2023-10-25 20:31 Status:LearningIT Tags: Cryptography, Cryptography Hashing
Salt
A salt is random data fed as an additional input to a one-way function that hashes data, a password or passphrase. Salting helps defend against attacks that use precomputed tables (e.g. rainbow tables), by vastly growing the size of table needed for a successful attack. It also helps protect passwords that occur multiple times in a database, as a new salt is used for each password instance.
Without a salt, identical passwords will map to identical hash values, which could make it easier for a hacker to guess the passwords from their hash value.
Instead, a salt is generated and appended to each password, which causes the resultant hash to output different values for the same original password.
The salt and hash are then stored in the database. To later test if a password a user enters is correct, the same process can be performed on it (appending that user’s salt to the password and calculating the resultant hash): if the result doesn’t match the stored hash, it could not have been the correct password that was entered.
In practice, a salt is usually generated using existing data such as a user’s ID. If a completely random salt is created instead, it is stored in the hash (such as by prepending it, appending it, replacing every nth character with it, or so on) so the system can later recover it.