How deeply does Just Use Postgres! cover cryptographic salt?

Explains salt generation, hash storage, and verification SQL, but stops short of broader security administration.

Cryptographic salt

A cryptographic salt is a random value combined with a password before hashing to make identical passwords produce different hashes and to limit compromise scope.

A cryptographic salt is a random value combined with a password before hashing. Generating a fresh salt for every password makes identical passwords produce different hashes and limits a stolen salt's compromise to its associated password. section 7.2.2

Salted password storage in PostgreSQL

With pgcrypto enabled, create an account by combining the password with a Blowfish salt: INSERT INTO accounts (username, password_hash) VALUES ('ahamilton', crypt('SuperSecret123', gen_salt('bf'))); The resulting hash includes the salt. During login, pass the entered password and stored hash to crypt(); it extracts the stored salt and returns a matching row only when the password is correct.

Practical properties:

Generate a new random salt for every new password; avoid one fixed salt for all accounts. section 7.2.2

How Just Use Postgres! covers it

liveBook manning.com

Read Just Use Postgres! on liveBook Get the book at manning.com

Also explained in

liveBook manning.com

Hacking CryptographyA salt is a publicly known value combined with a password before hashing to make precomputed password-hash tables less reusable.
liveBook manning.com

Grokking Relational Database DesignA cryptographic salt is a random value combined with password input before hashing to make precomputed hash attacks less effective.
liveBook manning.com

Spring Security in Action, Second EditionA salt is additional key-like data combined with an input before a hashing or cryptographic operation to make repeated inputs produce distinct results.
liveBook manning.com

Grokking Web Application SecurityA salt is a random value added to input data before hashing so that identical inputs produce different hash values.

Compare how 5 books explain cryptographic salt →

Related concepts

saltingused by · Salting is the practice of combining data, especially a password, with an additional value before hashing to produce distinct hashes and hinder precomputed attacks.
gen_saltproduced by · gen_salt is a pgcrypto function that generates a random salt for password hashing using a specified algorithm.
password hashinguses · Password hashing is the use of a one-way, deliberately costly function to derive values for securely storing and verifying passwords without retaining the original passwords.
dictionary attackcontrasts with · A dictionary attack is a credential-guessing technique that tests candidate passwords or values drawn from a prepared list of common or likely choices.
rainbow tableaddresses · A rainbow table is a precomputed structure of chained password-hash values that accelerates recovery of plaintext passwords from unsalted hashes by trading storage for lookup time.

This explainer was generated by Manning's knowledge graph from the text of Just Use Postgres!. The section links point to the parts of the book it draws on.