Why do salts make dictionary attacks 'impossible'?
问题 Update: Please note I am not asking what a salt is, what a rainbow table is, what a dictionary attack is, or what the purpose of a salt is. I am querying: If you know the users salt and hash, isn't it quite easy to calculate their password? I understand the process, and implement it myself in some of my projects. s = random salt storedPassword = sha1(password + s) In the database you store: username | hashed_password | salt Every implementation of salting I have seen adds the salt either at