Cryptographic salt
A cryptographic salt is an additional typically random value combined with input before hashing to distinguish identical inputs and hinder precomputed attacks.
Hacking Cryptography
A salt is a publicly known value combined with a password before hashing to make precomputed password-hash tables less reusable.
- How it is used
- Counters dictionary and rainbow-table attacks against stored password digests by changing the hashed input.
- How deep it goes
- Explains precomputation attacks through rainbow-table code and identifies salts as a countermeasure, while deferring password hashing to dedicated functions.
- Examples
- Uses a leaked password-digest database, six-character passwords, plaintext salt storage, and a rainbow table exceeding a 20% cracking success rate.
- What you can do after
- Apply it via a dedicated password-hashing function by adding a salt before password hashing.
Grokking Relational Database Design
A cryptographic salt is a random value combined with password input before hashing to make precomputed hash attacks less effective.
- How it is used
- Protects stored database passwords against brute-force and rainbow-table attacks during application authentication.
- How deep it goes
- Defines salted hashing and walks through login verification, but does not detail salt-generation or storage implementation.
- Examples
- Uses compromised password databases, rainbow tables, and a step-by-step user login comparison as concrete security examples.
- What you can do after
- Apply it via salted password hashing and verify login attempts by comparing newly computed hashes.
Read how Grokking Relational Database Design explains cryptographic salt →
Spring Security in Action, Second Edition
A salt is additional key-like data combined with an input before a hashing or cryptographic operation to make repeated inputs produce distinct results.
- How it is used
- Strengthens hashing or encryption by adding a value to the input before processing.
- How deep it goes
- Defines the security role and shows Spring Security generators, but stops short of implementing a complete hashing workflow.
- Examples
- Uses StringKeyGenerator, secureRandom byte generators, configurable key lengths, and shared keys.
- What you can do after
- Apply it via Spring Security's KeyGenerators to produce string or byte salt values.
Read how Spring Security in Action, Second Edition explains cryptographic salt →
Grokking Web Application Security
A salt is a random value added to input data before hashing so that identical inputs produce different hash values.
- How it is used
- Protects stored passwords against precomputed cracking tables and reduces the value of stolen password hashes.
- How deep it goes
- Defines salting, explains per-password storage and attack cost, and demonstrates bcrypt usage without covering hash-function internals.
- Examples
- Uses bcrypt snippets that generate salts, store them beside hashes, and verify passwords with a configuration-held pepper.
- What you can do after
- Apply it via bcrypt by generating a unique salt, storing it with the hash, and recalculating the hash during password checks.
Read how Grokking Web Application Security explains cryptographic salt →
Just Use Postgres!
A cryptographic salt is a random value combined with a password before hashing to make identical passwords produce different hashes and to limit compromise scope.
- How it is used
- Uses per-password randomization to secure stored account passwords and limit the impact of database compromise.
- How deep it goes
- Explains salt generation, hash storage, and verification SQL, but stops short of broader security administration.
- Examples
- Demonstrates pgcrypto account insertion, stored hash output, successful authentication, and failed-password behavior.
- What you can do after
- Apply it via PostgreSQL pgcrypto to store and verify salted password hashes.
Related concepts
- saltingused by · Salting is the practice of combining data, especially a password, with an additional value before hashing to produce distinct hashes and hinder precomputed attacks.
- gen_saltproduced by · gen_salt is a pgcrypto function that generates a random salt for password hashing using a specified algorithm.
- password hashinguses · Password hashing is the use of a one-way, deliberately costly function to derive values for securely storing and verifying passwords without retaining the original passwords.
- dictionary attackcontrasts with · A dictionary attack is a credential-guessing technique that tests candidate passwords or values drawn from a prepared list of common or likely choices.
- rainbow tableaddresses · A rainbow table is a precomputed structure of chained password-hash values that accelerates recovery of plaintext passwords from unsalted hashes by trading storage for lookup time.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.