Contents
Can salts be stored in plaintext?
TL;DR – You can store the salt in plaintext without any form of obfuscation or encryption, but don’t just give it out to anyone who wants it. The reason we use salts is to stop precomputation attacks, such as rainbow tables.
What controls could be implemented to make cracking much harder for the hacker in the event of a password database leaking again?
What controls could be implemented to make cracking much harder for the hacker in the event of a password database leaking again? Prevent passwords to be the same as usernames or reused as part of the password – such password combination is easy to check without gaining access to the password database itself.
Is the Salt, IV and key necessary when encrypting password in?
If you use a salt, the salt will be XORed with the IV in the first block, and this (IV xor Salt) will effectively become the IV of the second, which given a 16 byte salt, would be your actual message to be encrypted. 4) Am I somehow supposed to use the salt to derive the key that I will use for encrypting “mypass” with AES?
Can a password be derived from a salt?
The salt is not secret, and therefore, if you were to do that, the key would be easily found from the non secret salt. I was getting this confused with password based encryption, where you use a key derivation function to derive the key from a secret password. 5) What am I supposed to store in my database?
Can a password be generated without the salt in OpenSSL?
The following is from the OpenSSL documentation: Without the -salt option it is possible to perform efficient dictionary attacks on the password and to attack stream cipher encrypted data. The reason for this is that without the salt the same password always generates the same encryption key.
Why does the same password generate the same encryption key?
The reason for this is that without the salt the same password always generates the same encryption key. When the salt is being used the first eight bytes of the encrypted data are reserved for the salt: it is generated at random when encrypting a file and read from the encrypted file when it is decrypted.