Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Despite the other reply you got (which was my original 'lol'), no, there isn't an advantage to salting a password that is going to be encrypted with symmetrical encryption. I mean, what would that even mean?

Encrypt("salt"+"password", key) = ENCRYPTED_DATA

Decrypt(ENCRYPTED_DATA, key) = "salt"+"password"



In short, it is BEST to HASH with a salt. Hash with a salt and don't use symmetrical key encryption methods.


Yup, always hash with a salt (or use an algorithm that does it for you). I added another example below for this guy. And yes, definitely don't use symmetric encryption.


Thanks. I'm no security expert but I couldn't see how it would make a difference.


Sure, to help illustrate it further: (don't use SHA1, I'm using it to avoid a discussion of why you wouldn't manually use a salt with bcrypt)

user1: SHA1("salt123"+"puppydog11") = SOME_HASH

user2: SHA1("salt456"+"puppydog11") = SOME_DIFF_HASH

This way, even for the same password, there are different salts, and thus different hashes. No one can run a rainbow attack unless they've generated rainbow tables for that salt (frankly, it would be possible, but useless to generate a rainbow table for a specific salt)




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: