A cryptographic salt is a random value combined with a password before hashing. It makes precomputed hash attacks, such as rainbow-table attacks, less effective. section 7.4
Password login, step by step
When a user creates an account, the application combines the password with a salt and stores the resulting hash. During login, it applies the same process to the supplied password and compares the new hash with the stored hash. A matching result authenticates the user. section 7.4
Use the pattern as a practical rule of thumb:
- Store password hashes rather than plain passwords. section 7.4
- Combine each password with its salt before hashing. section 7.4
- Compare hashes during authentication instead of trying to recover the original password. section 7.4
