问题
Possible Duplicate:
what is best possible way of salting and storing salt?
Improve password hashing with a random salt
Assuming that using a correct algorithm for password hashing and generating different salts for each password...
Is it a security risk to store salts separately from password hashes? For ex. in a database table, storing password hashes in one column, and password salts in a separate column?
I saw strategies where the salt is embedded into the password hash itself, by using a specific algorithm. Later on the salt can be extracted from the password hash. Is this more secure?
回答1:
From everything I have ever read and done, there is nothing wrong with storing the password hash and password salt in separate columns, and that is the most common way to do it.
The basic method for authentication should go something like this:
- Retrieve user_id and password_salt using user supplied username or email
- Concat user supplied password input with retrieved salt
- Use hashing algorithm on combined string
- Check created hash against the hash in the database
来源：https://stackoverflow.com/questions/13459031/storing-password-salts-separately-from-password-hashes