What is the purpose of the “salt” when hashing?

后端 未结 3 1351
南方客
南方客 2020-12-17 18:23

Ok, I’m trying to understand the reason to use salt.

When a user registers I generate a unique salt for him/her that I store in DB. Then I hash it and the password w

3条回答
  •  旧时难觅i
    2020-12-17 19:06

    If you don't use a salt then an attacker can precompute a password<->hash database offline even before they've broken into your server. Adding a salt massively increases the size of that database, making it harder to perform such an attack.

    Also, once they've broken in they can guess a commonly used password, hash it, and then check all of the passwords in the database for a match. With a different salt for each user, they can only attack one password at a time.

    There's an article at Wikipedia about salts in cryptography.

提交回复
热议问题