Improve password hashing with a random salt

by

An attacker is “allowed” to know the salt – your security must be designed in a way that even with the knowledge of the salt it is still secure.

What does the salt do ?

Salt aids in defending against brute-force attacks using pre-computed “rainbow-tables”.
Salt makes brute-force much more expensive (in time/memory terms) for the attacker.
Calculating such a table is expensive and usually only done when it can be used for more than one attack/password.
IF you use the same salt for all password an attacker could pre-compute such a table and then brute-force your passwords into cleartext…
As long as you generate a new (best cryptogrpahically strong) random salt for every password you want to store the hash of there is no problem.

IF you want to strengthen the security further
You could calculate the hash several times over (hash the hash etc.) – this doesn’t cost you much but it makes a brute-force attack / calculating “rainbow-tables” even more expensive… please don’t invent yourself – there are proven standard methods to do so, see for example http://en.wikipedia.org/wiki/PBKDF2 and http://www.itnewb.com/tutorial/Encrypting-Passwords-with-PHP-for-Storage-Using-the-RSA-PBKDF2-Standard

NOTE:

Using such a mechanism is these days mandatrory since “CPU time” (usable for attacks like rainbow tables/brute force etc.) is getting more and more widely available (see for example the fact that Amazon’s Cloud service is among the top 50 of fastest supercomuters worldwide and can be used by anyone for a comparatively small amount)!

More Related Contents:

  1. php mysqli_connect: authentication method unknown to the client [caching_sha2_password]
  2. Hiding true database object ID in url’s
  3. How Secure Is This Login System? (Using Cookies In PHP)
  4. How can I prevent SQL injection in PHP?
  5. SQL injection that gets around mysql_real_escape_string()
  6. Secure hash and salt for PHP passwords
  7. Is “mysqli_real_escape_string” enough to avoid SQL injection or other SQL attacks?
  8. Reference: What is a perfect code sample using the MySQL extension? [closed]
  9. How to create a secure mysql prepared statement in php?
  10. How do I use password hashing with PDO to make my code more secure? [closed]
  11. Using PHP 5.5’s password_hash and password_verify function
  12. Secure random number generation in PHP
  13. What does it mean to escape a string?
  14. SQL injections in ADOdb and general website security
  15. PHP MySQLI Prevent SQL Injection [duplicate]
  16. Why is using a mysql prepared statement more secure than using the common escape functions?
  17. Are mysql_real_escape_string() and mysql_escape_string() sufficient for app security?
  18. How to best store user information and user login and password
  19. how safe are PDO prepared statements
  20. encrypt and decrypt md5
  21. “slash before every quote” problem [duplicate]
  22. How to create a laravel hashed password
  23. a better approach than storing mysql password in plain text in config file?
  24. Fastest hash for non-cryptographic uses?
  25. Best way to connect to MySQL with PHP securely [duplicate]
  26. PHP DateTime supported formats
  27. You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ‘WHERE `id` [closed]
  28. split keywords for post php mysql
  29. Laravel Cannot delete or update a parent row: a foreign key constraint fails
  30. How to create PHP two column table with values from the database?

Leave a Comment