What is the purpose of a salt in password hashing?
Options
- To encrypt the final hash before it is stored away
- Equal passwords hash differently (stops rainbow tables) (Correct option)
- To make the hashing function run faster on each login
- To replace the need for multi-factor authentication
Answer
Make identical passwords hash differently, defeating precomputed rainbow tables
Why
A salt is a random value generated for each user and mixed into the password before hashing. It is stored next to the hash; it does not need to be secret.
Without salts, everyone with password '123456' has the same hash, and attackers can use huge precomputed tables (rainbow tables) to look hashes up instantly.
With salts, every hash is unique, so each password must be attacked separately.
Remember
Salt = random per-user value so equal passwords get different hashes.