Databases
StackOverflow2013
Postsdbo
POHow does password salt help against a rainbow table attack?
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POHow does password salt help against a rainbow table attack?
    primarykey
    data
    text
    <p>I'm having some trouble understanding the purpose of a salt to a password. It's my understanding that the primary use is to hamper a rainbow table attack. However, the methods I've seen to implement this don't seem to really make the problem harder.</p> <p>I've seen many tutorials suggesting that the salt be used as the following:</p> <pre><code>$hash = md5($salt.$password) </code></pre> <p>The reasoning being that the hash now maps not to the original password, but a combination of the password and the salt. But say <code>$salt=foo</code> and <code>$password=bar</code> and <code>$hash=3858f62230ac3c915f300c664312c63f</code>. Now somebody with a rainbow table could reverse the hash and come up with the input "foobar". They could then try all combinations of passwords (f, fo, foo, ... oobar, obar, bar, ar, ar). It might take a few more milliseconds to get the password, but not much else.</p> <p>The other use I've seen is on my linux system. In the /etc/shadow the hashed passwords are actually stored <em>with</em> the salt. For example, a salt of "foo" and password of "bar" would hash to this: <code>$1$foo$te5SBM.7C25fFDu6bIRbX1</code>. If a hacker somehow were able to get his hands on this file, I don't see what purpose the salt serves, since the reverse hash of <code>te5SBM.7C25fFDu6bIRbX</code> is known to contain "foo".</p> <p>Thanks for any light anybody can shed on this.</p> <p><strong>EDIT</strong>: Thanks for the help. To summarize what I understand, the salt makes the hashed password more complex, thus making it much less likely to exist in a precomputed rainbow table. What I misunderstood before was that I was assuming a rainbow table existed for ALL hashes.</p>
    singulars
    1. PO
      singulars
      1. PTAnswer
    1. This table or related slice is empty.
    1. PTQuestion
    1. USRich
    1. USRich
    plurals
    1. PL
      singulars
      1. LTLinked
    2. PL
      singulars
      1. LTLinked
    3. PL
      singulars
      1. LTLinked
    1. PL
      singulars
      1. LTLinked
    2. PL
      singulars
      1. LTLinked
    3. PL
      singulars
      1. LTLinked
    1. This table or related slice is empty.
    1. PO
      singulars
      1. PTAnswer
    2. PO
      singulars
      1. PTAnswer
    3. PO
      singulars
      1. PTAnswer
    1. VO
      singulars
      1. POHow does password salt help against a rainbow table attack?
      1. USCros
      1. VTFavorite
    2. VO
      singulars
      1. POHow does password salt help against a rainbow table attack?
      1. This table or related slice is empty.
      1. VTUpMod
    3. VO
      singulars
      1. POHow does password salt help against a rainbow table attack?
      1. This table or related slice is empty.
      1. VTUpMod
    1. COSee also http://stackoverflow.com/questions/213380/the-necessity-of-hiding-the-salt-for-a-hash
      singulars
      1. POHow does password salt help against a rainbow table attack?
      1. USerickson
    2. COAnd see also: http://stackoverflow.com/questions/1645161/salt-generation-and-open-source-software/1645190#1645190
      singulars
      1. POHow does password salt help against a rainbow table attack?
      1. USJacco
    3. COAlso, updated here - use of md5 hashing is no longer best practice. http://stackoverflow.com/questions/12724935/salt-and-passwords
      singulars
      1. POHow does password salt help against a rainbow table attack?
      1. USStuartLC
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload