📖 What is Salting?
Salting is the process of adding a unique, random string of characters to a password before it is hashed. This technique prevents attackers from using precomputed rainbow tables to crack passwords, as the same password will result in a different hash for every user.
"Understand that salt is stored in plaintext alongside the hash; it does not need to be secret, just unique."
📚 Certification: CompTIA PenTest+ (PT0-002)
🔑 What are the Key Concepts of Salting?
- ▸ Salting neutralizes rainbow table attacks by ensuring that precomputed hash lists do not match the salted versions of common passwords.
- ▸ Using a unique salt per user ensures that two identical passwords will result in completely different hash values in the database.
- ▸ Salts are stored in plaintext alongside the hash; they are not intended to be secret, but must be unique for every entry.
- ▸ Salting forces attackers to perform brute-force or dictionary attacks for each user individually, exponentially increasing the total time required for cracking.
- ▸ Modern password hashing algorithms like bcrypt and scrypt implement salting automatically, reducing the likelihood of developer implementation errors.
🎯 How does Salting appear on the PT0-002 Exam?
A scenario might describe an attacker who has obtained a password database but finds that their precomputed rainbow tables are ineffective, requiring you to identify salting as the cause.
You may be asked to recommend a mitigation strategy for a client whose application stores passwords using a fast hashing algorithm without any unique random additions.
Expect questions where you must distinguish between salting and peppering, specifically focusing on whether the additional string is stored in the database or a separate configuration file.
❓ Frequently Asked Questions
Does the salt need to be kept secret to be effective?
No, the salt is stored in plaintext alongside the hash. Its purpose is not to act as a secret key, but to ensure that identical passwords produce unique hashes, rendering precomputed rainbow tables useless.
How does salting differ from peppering?
A salt is unique for every user and stored in the database. A pepper is a single secret value added to all passwords and stored separately, such as in a secure configuration file or HSM.