What is SALT and how do i use it?

by

I am definitely not an expert, but the really short answer is that “salting” a line of text means to stick a few extra characters on the end of it. You could salt “salt” with “abcdefg” to get “saltabcdefg”. This might be useful if “salt” happens to be a password that you’d like to make more difficult to guess.

Typically, the password+salt are transformed (‘hashed’) by some difficult-to-reverse process into a completely different string. This transformed string is then stored as the password, together with the plaintext of the salt, and the original plain text of the password proper is tossed away. When you want to check that someone has input the correct password, you combine whatever they’ve typed in with the salt that’s listed in the password file and then hash the result. If the result matches the password hash you have on record, then you know that they’ve put in the right password.

Implementing a salt can be as easy as picking a string to serve as the salt and then making sure you keep track of it. But, you could vary the salt with each password, and then you’ll have to have a way of keeping track of password+salt combinations as well as generating the variations. Of course, you’ll probably also want to hash the password rather than saving the password’s plain text, and so you’ll have to pick a hash function. At this point, the problem has proceeded from salting proper to implementing a password security scheme.

For PHP, you might want to look at how some of the frameworks have implemented this. Two quick links, for CakePHP and Zend, respectively:

http://www.jotlab.com/2010/04/18/cakephp-rainbow-table-protection-behaviour/

http://www.zimuel.it/blog/2009/07/build-a-secure-login-with-zend-framework/

More Related Contents:

  1. How to use PHP’s password_hash to hash and verify passwords
  2. How can I store my users’ passwords safely?
  3. How to retract a salted password from the Database and auth user?
  4. bcrypt and randomly generated salts
  5. Why does crypt/blowfish generate the same hash with two different salts?
  6. Combine multiple sql / mysql queries in one query
  7. Just using mysql real escape string [closed]
  8. URL rewriting with PHP
  9. Split a comma-delimited string into an array?
  10. Object of class mysqli_result could not be converted to string
  11. Why does PHP consider 0 to be equal to a string?
  12. Many-to-many relationships examples
  13. including a remote file in PHP
  14. On delete cascade with doctrine2
  15. php date validation
  16. How to alias a table in Laravel Eloquent queries (or using Query Builder)?
  17. Do login forms need tokens against CSRF attacks?
  18. Fastest way to add prefix to array keys?
  19. configure multiple databases in zf2
  20. mySQLi prepared statement unable to get_result()
  21. Check if specific input file is empty
  22. MySQL Performance – “IN” Clause vs. Equals (=) for a Single Value [duplicate]
  23. How to change PHP version used by composer
  24. PHP: Split string into array, like explode with no delimiter
  25. Creating anonymous objects in php
  26. Use a variable within heredoc in PHP
  27. imagecreatefromjpeg and similar functions are not working in PHP
  28. Group array values based on key in php? [duplicate]
  29. PHP: What if I call a static method in non-static way
  30. Is there a call_user_func() equivalent to create a new class instance?

Leave a Comment