Why do salts make dictionary attacks 'impossible'?

后端 未结 11 1725
长情又很酷
长情又很酷 2020-11-28 01:23

Update: Please note I am not asking what a salt is, what a rainbow table is, what a dictionary attack is, or what the purpose of a salt is. I am querying: If you kno

11条回答
  •  谎友^
    谎友^ (楼主)
    2020-11-28 01:57

    The point of salting is to prevent the amortization of the attacker's effort.

    With no salt, a single table of precomputed hash-password entries (e.g. MD5 of all alphanumeric 5 character strings, easy to find online) can be used on every user in every database in the world.

    With a site-specific salt, the attacker has to compute the table himself and can then use it on all users of the site.

    With a per-user salt, the attacker has to expend this effort for every user separately.

    Of course, this doesn't do much to protect really weak passwords straight out of a dictionary, but it protects reasonably strong passwords against this amortization.

提交回复
热议问题