Where to store your salt

From: Edgar Sánchez (edgar.sanchez_at_logicstudio.net)
Date: 01/24/04

  • Next message: Rea Peleg: "consuming webservice over ssl problem" 
    Date: Fri, 23 Jan 2004 22:41:26 -0500

    Reviewing the code in "Building Secure Microsoft ASP.NET Applications" for
    hashing passwords with salt, I see that the salt is stored in the same table
    as the hashed password. The idea of using salt is to make a dictionary
    attack harder but if we store the salt close to the hashed password then the
    attacker can attach the salt to the dictionary passwords and go on with
    his/her attack. For what I understood of the salting technique, the salt
    should be saved somewhere else, is this right or I am missing something?

  • Next message: Rea Peleg: "consuming webservice over ssl problem"

    Relevant Pages

    • Re: Importance of salt
      ... About passwords in cryptography - there are tons of resources, ... Passwords and Offline Guessing Attacks. ... > I have one question regarding the importance of salt in encryption. ... the salt is used to prevent dictionary attacks. ...
      (microsoft.public.dotnet.security)
    • Re: Authenticate a User.
      ... > contain crypted passwords. ... >> That is because the salt may be longer than 2 characters. ... This is true if you're using the MD5 version of crypt, ... then a longer salt is obviously a possible explanation. ...
      (comp.os.linux.development.apps)
    • Re: Encrypt a UsernameToken Authenticated WSE Response
      ... add another word, case sensitivity, or a number, ... and most people cant manage their passwords. ... >> you can also make is stronger by prepending SALT. ... > That is because normally salt is sent to the client in clear text so it is ...
      (microsoft.public.dotnet.framework.webservices.enhancements)
    • Re: Importance of salt
      ... Dominick Baier - DevelopMentor ... > About passwords in cryptography - there are tons of resources, ... >> I have one question regarding the importance of salt in encryption. ... the salt is used to prevent dictionary attacks. ...
      (microsoft.public.dotnet.security)
    • RE: [HACKERS] Postgres: pg_hba.conf, md5, pg_shadow, encrypted passwords
      ... through an entire shadow file for the hash. ... In the case of the postgres passwords, the user name seems to act as a ... sort of "public" salt. ... > pre-computation of a dictionaries infeasable due to storage ...
      (Bugtraq)