CODEWITHSUNDEEP
securityencryptionhashsalt-cryptography
Aaron
Aaron

Reputation: 10858

Salting - the order of steps

When salting a password, which is the correct way (or most effective way)?

A. First hash the password and then hash the hash of the password with the salt like this:

$password = "passwd";

$salt = "s0merndslt";

$password = sha1($password);

$salty = sha1($password.$salt);

B. Take the password and the salt and hash them together like this:

$password = "passwd";

$salt = "s0merndslt";

$salty = sha1($password.$salt);

My apologies if this has been asked before but I could not find the answer to this specific part of salting on SO.

Upvotes: 0

Views: 245

Answers (1)

Yann Ramin
Yann Ramin

Reputation: 33197

In reality, either case.

However, your example #1 provides a time tradeoff which will (slightly) slow down brute force password finders.

With the advent of GPUs, simply salting passwords is not enough. A GPU-backed brute-force password tool, when given a set of passwords to find, can accomplish short passwords in a matter of minutes (or even seconds).

This is why tools or algorithms such as bcrypt or PBKDF#2 exist: they iterate the hashing operation many times to produce a large workload, which makes finding passwords from a hash "infeasible" on commodity hardware.

When in doubt, don't implement your own password hash solution! Use bcrypt or PBKDF#2.

Upvotes: 2

Related Questions