Salted Hash Password Authentication

Question

I've been reading up on OWASP 10 and I came across the best practice to store information. Salted hashing. Where you generate one random salt for every password and combing it and hash it and store it. My doubt is, if the salt is generated randomly how the password be authenticated when the user types it? Is the salt saved along with the user name? If so, this practice is still vulnerable. OR how do they do it?

Answer 1

The salt is saved along with the user name. Salts are not secret. The point of a salt is to ensure that if two people have the same password, they won't have the same hashed password. This prevents pre-computed hash attacks (rainbow tables), and prevents leaking that two users in a database have the same password.

While per-user random salts are ideal, the benefits of salting can also be achieved with deterministic, but unique, salts. For example, you can use some fixed string for your database and join that with the userid (com.example.mygreatsystem:[email protected]) and use that as the salt. Since it's unique to every user (not just within this system, but globally), it achieves the same goals as a random salt without requiring an extra database lookup. Like with random salts, this scheme does not need to be secret. The important part of a salt is it be unique. But when practical, a per-user random salt of sufficient length (typically 8 random bytes), stored with the user record, is best practice.