What does 'salt' refer to in string-to-key (s2k) specifier?

445 Views Asked by At

What does 'salt' refer to in string-to-key (s2k) specifier?

It appears to be a random number generator to shake things up, but I would like to know what 'salt' stands for?

For example it is written:

3.6.1.2. Salted S2K

   This includes a "salt" value in the S2K specifier -- some arbitrary
   data -- that gets hashed along with the passphrase string, to help
   prevent dictionary attacks.

       Octet 0:        0x01
       Octet 1:        hash algorithm
       Octets 2-9:     8-octet salt value

   Salted S2K is exactly like Simple S2K, except that the input to the
   hash function(s) consists of the 8 octets of salt from the S2K
   specifier, followed by the passphrase.

But salt is not defined, although its meaning seems clear.

3

There are 3 best solutions below

6
Mark Byers On BEST ANSWER

From Wikipedia:

In cryptography, a salt comprises of random bits that are used as one of the inputs to a key derivation function. The other input is usually a password or passphrase. The output of the key derivation function is stored as the encrypted version of the password.

A salt is just some bits that are used to increase the security of the system. They help prevent pre-computed dictionary attacks.

2
o0'. On

The salt can be any consistent value.

Either a constant, or the user ID. Better if it includes both.

This is used to prevent pre generated rainbow tables from working.

0
harpo On

I think you're asking the origin of the term, not the definition.

Time for a round of folk etymology! (Until someone gives the real answer.)

My guess is that it is an analogy from cooking: the salt is an improving additive. And a little bit goes a long way.