Is time() a good salt?

后端 未结 9 1011
灰色年华
灰色年华 2020-12-02 05:40

I\'m looking at some code that I have not written myself. The code tries to hash a password with SHA512 and uses just time() as the salt. Is time()

9条回答
  •  -上瘾入骨i
    2020-12-02 06:33

    The user name should be sufficient enough and perhaps the registration time stamp, but you should store it somewhere in the database. Anyway every value you use to salt your password hash, should be stored some way, so you can recalculate the hash.

    Is salting with user name + a time stamp secure enough? It should be. For cracking SHA512 Hashes normally Rainbow Tables are used. A user name + a time stamp should be a salt which is uniquq enough, so there is no way there is some Rainbow Table on the net which contains precalculated hashes with passwords, which are salted this way.

提交回复
热议问题