Re:How crackers ransack passwords like “qeadzcwrsfxv1331”
by theboss on Tuesday May 28, 2013 @12:57AM
(#5778163)
Salting would definitely make a difference. The point of salting is to increase the complexity and overhead of generating rainbow tables.
The first mistake here is the use of MD5. MD5 is flat out broken. Do Not use md5. Do use bcrypt.
In your db, you can store the salt right there....next to the hash...
How a salt increases the complexity is quite simple. If a attack has a giant rainbow table, the salt causes him to increase the size of his rainbow table and the space required to hold it and the pre-processing time to generate it. For example
Here is what your database might look like with a 3 byte salt
password : salt
hunter2 : 100
qwerty1 : 101
Here is what the attacks rainbow tables will have to look like
qwerty1 : 101
hunter2 : 100
qwerty1 : 100
hunter2 : 101
hunter2 : 103
qwerty1 : 102
...
..
.
That's about it. There are other purposes of the salt too but other people talked about those ones.
The first mistake here is the use of MD5. MD5 is flat out broken. Do Not use md5. Do use bcrypt.
In your db, you can store the salt right there....next to the hash...
How a salt increases the complexity is quite simple. If a attack has a giant rainbow table, the salt causes him to increase the size of his rainbow table and the space required to hold it and the pre-processing time to generate it. For example
Here is what your database might look like with a 3 byte salt
password : salt
hunter2 : 100
qwerty1 : 101
Here is what the attacks rainbow tables will have to look like
qwerty1 : 101
hunter2 : 100
qwerty1 : 100
hunter2 : 101
hunter2 : 103
qwerty1 : 102
...
..
.
That's about it. There are other purposes of the salt too but other people talked about those ones.