How can bcrypt have built-in salts?

前端 未结 4 716
终归单人心
终归单人心 2020-11-22 10:12

Coda Hale\'s article "How To Safely Store a Password" claims that:

bcrypt has salts built-in to prevent rainbow table attacks.

4条回答
  •  庸人自扰
    2020-11-22 10:49

    I believe that phrase should have been worded as follows:

    bcrypt has salts built into the generated hashes to prevent rainbow table attacks.

    The bcrypt utility itself does not appear to maintain a list of salts. Rather, salts are generated randomly and appended to the output of the function so that they are remembered later on (according to the Java implementation of bcrypt). Put another way, the "hash" generated by bcrypt is not just the hash. Rather, it is the hash and the salt concatenated.

提交回复
热议问题