📖 What is Password Salting?
Password Salting is the process of adding a unique, random string of characters to a password before it is hashed. This prevents attackers from using precomputed tables, like rainbow tables, to crack passwords during an offline attack on a stolen database.
"Salting doesn't make the hashing algorithm itself stronger, but it ensures that two users with the same password will have completely different hash values."
📚 Certification: CompTIA PenTest+ (PT0-002)
🔑 What are the Key Concepts of Password Salting?
- ▸ Rainbow table mitigation: Salting prevents attackers from using precomputed hash tables, as the unique salt changes the resulting hash for every password.
- ▸ Unique per-user salts: Using a different salt for every user ensures that two people with the same password will have distinct hash values.
- ▸ Storage requirements: The salt is stored in plain text within the database alongside the hash, as it is not intended to be a secret.
- ▸ Defense against offline attacks: Salting is primarily used to protect stored credentials after a database breach, forcing attackers to crack passwords individually.
- ▸ Integration with slow hashes: For maximum security, salting is combined with iterative hashing algorithms like bcrypt or Argon2 to slow down brute-force attempts.
🎯 How does Password Salting appear on the PT0-002 Exam?
You may be asked to analyze a database dump containing columns for 'username', 'password_hash', and 'salt'. You must explain why a rainbow table attack is ineffective in this specific scenario.
A scenario might describe two users who both chose 'Password123' but have completely different hash values in the system. You will need to identify salting as the mechanism causing this.
Expect questions where you must recommend improvements to a legacy authentication system that uses simple MD5 hashes. The correct answer will involve implementing unique salts and a slow hashing function.
❓ Frequently Asked Questions
Does salting prevent a brute-force or dictionary attack?
No, salting does not stop these attacks, but it makes them significantly slower. Attackers can no longer crack multiple identical passwords simultaneously; they must brute-force each user's unique salt and password combination individually.
What is the difference between a salt and a pepper?
A salt is unique per user and stored in the database. A pepper is a secret value added to all passwords, stored separately from the database (like in a config file) to provide an extra layer of security.