CODEWITHSUNDEEP
salt-cryptographys2k
WilliamKF
WilliamKF

Reputation: 43139

What does 'salt' refer to in string-to-key (s2k) specifier?

What does 'salt' refer to in string-to-key (s2k) specifier?

It appears to be a random number generator to shake things up, but I would like to know what 'salt' stands for?

For example it is written:

3.6.1.2. Salted S2K

   This includes a "salt" value in the S2K specifier -- some arbitrary
   data -- that gets hashed along with the passphrase string, to help
   prevent dictionary attacks.

       Octet 0:        0x01
       Octet 1:        hash algorithm
       Octets 2-9:     8-octet salt value

   Salted S2K is exactly like Simple S2K, except that the input to the
   hash function(s) consists of the 8 octets of salt from the S2K
   specifier, followed by the passphrase.

But salt is not defined, although its meaning seems clear.

Upvotes: 3

Views: 488

Answers (3)

harpo
harpo

Reputation: 43168

I think you're asking the origin of the term, not the definition.

Time for a round of folk etymology! (Until someone gives the real answer.)

My guess is that it is an analogy from cooking: the salt is an improving additive. And a little bit goes a long way.

Upvotes: 2

o0'.
o0'.

Reputation: 11863

The salt can be any consistent value.

Either a constant, or the user ID. Better if it includes both.

This is used to prevent pre generated rainbow tables from working.

Upvotes: 3

Mark Byers
Mark Byers

Reputation: 838376

From Wikipedia:

In cryptography, a salt comprises of random bits that are used as one of the inputs to a key derivation function. The other input is usually a password or passphrase. The output of the key derivation function is stored as the encrypted version of the password.

A salt is just some bits that are used to increase the security of the system. They help prevent pre-computed dictionary attacks.

Upvotes: 3

Related Questions