Re: Values to use for a salt?

From: Dave Aronson (spamtrap.secfocus_at_dja.mailme.org)
Date: 12/16/03

  • Next message: Marian Ion: "Re: Values to use for a salt?" 
    To: secprog@securityfocus.com
Date: Tue, 16 Dec 2003 12:35:29 -0500

    On Mon December 15 2003 14:32, Craig Minton wrote:

    > Someone suggested recently of using the password as the salt.

    Ask yourself how you would go about attacking the password file of a
    site known to do this.

    (minor bit of "spoiler space" here)

    You'd simply prepare a dictionary to retrieve x from hash(x+x) (or
    however the salt is applied), rather than directly from hash(x) as
    usual. This really just means that the total hashing algorithm is
    slightly changed, to be about twice as CPU intensive.

    The salt should be as unrelated as possible to the thing being hashed,
    so as to make the maximum possible combinations of password and salt
    that need to be precomputed.

    > What would be wrong with this, especially if it
    > were altered in some way before being used, such as using a simple
    > replacement table to change letters to special characters?

    If you mean some standardized table, this won't help at all -- the
    attackers would know it too, so it's just hash(x+mangle(x)). Again, no
    real effect other than a tiny bit of added processing.

    If your site uses its own S00per Sekr1t randomly generated substitution
    table, that could help... so long as your table is indeed kept secret.
    However, Security By Obscurity is generally a Bad Idea.

    > Also, how much less secure would it be to use a user ID as the salt
    > instead of a random salt that then has to be stored?

    That would be reasonable. It is different for each user (except see
    below), and therefore requires a different dictionary per user, which
    is the main goal of a salt.

    However, it has the drawback of being in a very predictable range on
    most systems, and sometimes identical for several important users
    (i.e., 0). Therefore, once again, the effort that goes into
    precomputing the salted hashes, can be spread out over lots and lots of
    systems.

    Ideally, you want any dictionary the attacker has already computed, to
    be utterly useless against your system. Therefore, you want something
    unlikely to be duplicated elsewhere, let alone among multiple users of
    your own system. Random (and large) really is best, by far.... 

    -- 
Dave Aronson, Senior Software Engineer, Secure Software Inc.
(Opinions above NOT those of securesw.com unless so stated!)
Email me at: work (D0T) 2004 (@T) dja (D0T) mailme (D0T) org
Web: http://destined.to/program http://listen.to/davearonson
  • Next message: Marian Ion: "Re: Values to use for a salt?"

    Relevant Pages

    • Re: Hashed password secure?
      ... Consider the way that a typical password hash attack program works. ... the salt, and then it hashes the dictionary once for each unique salt value ... again, 2^8 different salt values in the password file, but the attacker ... But what about the legitimate verifier? ...
      (sci.crypt)
    • Re: How good an encryption algorithm is this?
      ... I see the hashed value "xyz" in the file, ... and you then store two values in the password file - the ... salt and the hashed value. ... bottom line - salt only addresses one kind of attack -the dictionary attack, ...
      (microsoft.public.dotnet.languages.csharp)
    • Re: How good an encryption algorithm is this?
      ... I see the hashed value "xyz" in the file, ... and you then store two values in the password file - the ... salt and the hashed value. ... bottom line - salt only addresses one kind of attack -the dictionary attack, ...
      (microsoft.public.vc.language)
    • Re: virtue of salted passwords
      ... >search is to append the salt to every word. ... the login authentication takes the characters ... If the hash just created matches - you're in. ... The reason for the salt was that originally, the password file was ...
      (alt.computer.security)
    • Re: password salting
      ... If you have the salt and the hash, the salt does not make attacking your ... |>> Joe Kaplan-MS MVP Directory Services Programming ...
      (microsoft.public.dotnet.security)