What is "salt" when relating to MYSQL sha1?

mysql sha1 salt
Noah R picture Noah R · Dec 4, 2010 · Viewed 25.7k times · Source

What is "salt" when relating to MYSQL sha1? I have no idea what salt is when relating to sha1 password encryptions? Can someone please explain what it is?

Answer

cfeduke picture cfeduke · Dec 4, 2010

A salt is a value that is added to a password (or other secret) which you want to hash one way. This means it could be before, after, or somewhere inside the password, as long as its position and value is consistent for a given supplied password.

What this does is it mitigates dictionary attacks - basically dictionaries of common passwords pre-hashed with no salt - from being used to "guess" a one way password as long as the attacker does not know the hash. If every password has a different hash then it makes it very difficult for an attacker to create a dictionary optimized for cracking your passwords (they would need a dictionary for each separate salt and they would also need to know where the salt was placed in each password).

Of course for all of this to be applicable an attacker must have the hashes of your passwords in the first place. This has nothing to do with attacking passwords by guessing them through some input prompt.

Regarding MySQL specifically if you provide a salt when hashing a password, make sure you record what that salt was somewhere. Then when a user attempts authentication you combine that recorded salt value with the password (during the call to crypt for example) and if the resulting hash matches then they have entered the correct password. (Note that at no time is the hashing of a password reversed; thus one way.)

Related questions

Storing SHA1 hash values in MySQL

I have a simple question which occured when I wanted to store the result of a SHA1 hash in a MySQL database: How long should the VARCHAR field be in which I store the hash's result?

Read More
How do you securely store a user's password and salt in MySQL?

So, I found out on SO that you're supposed to hash the password together with a "salt". (The articles can be found here and here.) Here's the code: $password = 'fish'; /* should be "unique" for every user? */ $salt= 'ABC09'; $site_…

Read More
Is there an equivalent to SHA1() in MS-SQL?

Converting a couple stored procedures from MySQL to Microsoft SQL server. Everything is going well, except one procedure used the MySQL SHA1() function. I cannot seem to find an equivalent to this in MS-SQL. Does anyone know a valid equivalent …

Read More