Salting

As explained in Hacking Cryptography

Salting is the practice of combining a password with an additional value before hashing it so that precomputed password-hash tables are specific to that value.

Salting combines a password with an additional value before hashing. The salt makes precomputed password-hash tables specific to that value, so a table built for unsalted passwords cannot be reused directly against salted digests. A salt is stored in plaintext with the digest; secrecy is not its purpose. section 6.4.2

The threat is precomputation. An attacker can hash many candidate passwords in advance, retain the results in a dictionary or rainbow table, and perform fast lookups after a credential database leaks. Salting changes the input to the hash, forcing the attacker to build new tables for the added value rather than sharing one reusable table across targets. section 6.4.2 section 10.1.4

Stored password digest

Instead of storing a digest produced from a password alone, store the salt alongside the digest and include that salt whenever the password is hashed for authentication. The plaintext salt lets the system reproduce the same hash input, while making a precomputed table tied to that salt. section 6.4.2

Figure 6.9 Salts are used to make hash function output more unpredictable; the salts are stored in plaintext along with the digest values.

The diagram contrasts digest storage with salted hashing: salts accompany digest values in plaintext and make hash output less predictable for precomputation attacks. section 6.4.2

Use salting as part of password storage defense:

• Add a salt before hashing passwords to make attackers build new rainbow tables. section 10.1.4
• Do not rely on a general-purpose fast hash alone; use a dedicated password-hashing function such as PBKDF2 or Argon2, which also require salting. section 10.1.4
• Treat long, complex passwords as a separate defense because they enlarge the candidate space attackers must precompute. section 6.4.2

How Hacking Cryptography covers it

How deep it goes

Explains the attack mechanism, plaintext salt storage, and operational password-hashing guidance without specifying salt-generation details.

Examples

Uses leaked username-and-digest databases, six-character password cracking, and a diagram of plaintext salts stored with digests.

What it assumes

Assumes familiarity with passwords and hash digests while explaining dictionary and rainbow-table attacks concretely.

What you can do after

Apply it via a dedicated password-hashing function by adding and storing a salt with each password digest.

How it connects

Connects password hashing with dictionary attacks, rainbow tables, PBKDF2, and Argon2.

liveBookmanning.com

Read Hacking Cryptography on liveBook Get the book at manning.com

Related concepts

• cryptographic saltuses · A cryptographic salt is an additional typically random value combined with input before hashing to distinguish identical inputs and hinder precomputed attacks.
• Mapaddresses · A map is an associative data structure that stores key-value pairs and supports retrieving values by key.
• rainbow tableaddresses · A rainbow table is a precomputed structure of chained password-hash values that accelerates recovery of plaintext passwords from unsalted hashes by trading storage for lookup time.
• dictionary attackaddresses · A dictionary attack is a credential-guessing technique that tests candidate passwords or values drawn from a prepared list of common or likely choices.
• password hashingpart of · Password hashing is the use of a one-way, deliberately costly function to derive values for securely storing and verifying passwords without retaining the original passwords.

This explainer was generated by Manning's knowledge graph from the text of Hacking Cryptography. The section links point to the parts of the book it draws on.