Salting
- •
def
- •
random data added to an input before hashing, so the resulting digest is harder to reverse-engineer by guessing common inputs
- •
- •
purpose
- •
without salting, an attacker could hash every likely password guess and compare digests to find a match; salting makes this brute-force approach far less practical, since the attacker doesn't know the salt value either
- •
defeats rainbow tables — precomputed hash lookup tables stop working once each password has its own random salt, since the same password now produces a different hash for every user
- •
- •
note
- •
every user gets their own random salt; the salt is commonly stored alongside the resulting hash (it isn't secret on its own), but combining it with the input still meaningfully raises the cost of guessing — this slows down brute forcing, it doesn't completely stop it
- •
- •
example
- •
the same password ("dragon") salted differently for different users produces a completely different hash each time — e.g.,
dragon+gsEVxanddragon+LTBkPhash to totally unrelated digests, even though the base password is identical
- •
- •
related
- •