I've been reading up on using a salt value when creating a password to make it more secure, what I can't get my head round is how do you remember this salt value?
I'm guessing that when a user logs in to be able to compare the password entered with the one in the database you would need to again add the salt value to the entered password.
I've been reading up on using a salt value when creating a password to make it more secure, what I can't get my head round is how do you remember this salt value?
You don't; you just test a lot of salts. That's why salts are small, to make that tolerable.
The point is to add a lot more computational work to anyone trying to brute-force a hash. They can't just compare a list of known hashes to a shadow file.
At least for passwords made with crypt() (see 'man 3 crypt'), the salt is the first two characters of the generated hash - this makes duplicates look different, while allowing easy computation when entering the password.
Here's a test program I wrote a while ago demonstrating basic use of crypt(), but still find useful - if you run it you'll notice the first two characters of the output are the two-byte salt (compile with '-lcrypt'):
I would like to know where the hash and salt are in Wordpress and Joomla hashes?
For example: In this wordpress hash P$BTBCNLQpY5CWWQ6XC4WJ6IPJQ877s3 where the salt is?
In this Joomla hash $2y$10$io60pn4npWCRWwg4308pB.4rLmfz.vFwzxzYmX6W48Ff7wTi7ZEMO where the salt is?
For example (source... (1 Reply)
Hey all, i have an application i am developing and i would like to use the
OpenSSL des3 encryption, the only problem i am having is when i need to input the second key verification. Heres what i have so far
openssl des3 -salt -in /tmp -out pwenc.z | echo 1111
usually for password verification... (0 Replies)
Unix protect its password by using salt
It that mean larger the salt size the more secure?
if the salt size increase greatly, will the password still able to be cracked?
thank you for helping (1 Reply)
Hi, lads. Good day.
I have one question to ask.
I read on the Internet, for the SUSE system, the password is encrypted into 13 characters, and the first 2 characters are called salt characters? Is there any special meaning for salt? Why we need these salt characters?
And, I have a look at... (1 Reply)