However, with a salt, the software must start again from scratch for each user. Therefore, without salt, after discovering the password of toto, the password of tata is directly discovered. Password cracking software (hashcat, Johntheripper…), after breaking a hash, look to see if it is not present for another user.

As said before, two users with the same password will not have the same hash if salt is used.

Rainbow tables do not work with salted hash.

However, the salt must be long enough and random.

It is almost impossible to find hash directly on the internet if it is salted.

It increases the chance that a password is unique and therefore the chance that a hash has never been used.įor example, with salt, toto and tata will not have the same hash in the database. The salt is unique for each user and is composed of a random sequence.

The salt is a pollutant to the raw data (here the password) allowing producing two different hashes from the same data. However, the purpose of these functions is to be used to compute a cryptographic summary to check the integrity of a file, to make an electronic signature, or to optimise search and indexing.

It is also interesting to note that since hashs do not have a notion of randomness, toto and tata share the same hash, as they have the same password.Ī simple search of the admin’s hash on the internet allows to directly retrieve their passwords.Īfter seeing the previous bad examples, it is tempting to use secure irreversible functions like sha256, sha512, or sha3.

In our case, all passwords (except Billy’s) are very frequently used passwords and are among the most used passwords (for example in the 10-million-password-list-top-1000.txt).

Let’s take the following database (the passwords are the same as earlier) Login For example, the LinkedIn site used to store part of its passwords with sha1, and after the hash leaks in 2012, it took only three days to recover 90% of the passwords. In many cases, passwords are stored with outdated irreversible cryptographic functions (md5, sha1…).

Ms access password storage