Where to store your salt

From: Edgar Sánchez (edgar.sanchez_at_logicstudio.net)
Date: 01/24/04 

Date: Fri, 23 Jan 2004 22:41:03 -0500

Reviewing the code in "Building Secure Microsoft ASP.NET Applications" for
hashing passwords with salt, I see that the salt is stored in the same table
as the hashed password. The idea of using salt is to make a dictionary
attack harder but if we store the salt close to the hashed password then the
attacker can attach the salt to the dictionary passwords and go on with
his/her attack. For what I understood of the salting technique, the salt
should be saved somewhere else, is this right or I am missing something?

Relevant Pages

  • Re: Importance of salt
    ... About passwords in cryptography - there are tons of resources, ... Passwords and Offline Guessing Attacks. ... > I have one question regarding the importance of salt in encryption. ... the salt is used to prevent dictionary attacks. ...
    (microsoft.public.dotnet.security)
  • Re: Authenticate a User.
    ... > contain crypted passwords. ... >> That is because the salt may be longer than 2 characters. ... This is true if you're using the MD5 version of crypt, ... then a longer salt is obviously a possible explanation. ...
    (comp.os.linux.development.apps)
  • Re: Encrypt a UsernameToken Authenticated WSE Response
    ... add another word, case sensitivity, or a number, ... and most people cant manage their passwords. ... >> you can also make is stronger by prepending SALT. ... > That is because normally salt is sent to the client in clear text so it is ...
    (microsoft.public.dotnet.framework.webservices.enhancements)
  • Re: Importance of salt
    ... Dominick Baier - DevelopMentor ... > About passwords in cryptography - there are tons of resources, ... >> I have one question regarding the importance of salt in encryption. ... the salt is used to prevent dictionary attacks. ...
    (microsoft.public.dotnet.security)
  • RE: [HACKERS] Postgres: pg_hba.conf, md5, pg_shadow, encrypted passwords
    ... through an entire shadow file for the hash. ... In the case of the postgres passwords, the user name seems to act as a ... sort of "public" salt. ... > pre-computation of a dictionaries infeasable due to storage ...
    (Bugtraq)