Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Adding the salt increases (albeit linearly) complexity of hashing w/ regard to brute forcing. So using a very long salt reduces hash speeds.


There are much better ways of reducing hash speed. Like hashing N times.


I am not discussing it, however:

>>It doesn’t affect how fast an attacker can try a candidate password, given the hash and the salt from your database<<

simply, it's a false statement. Multiple hashes while adding the same (huge) salt each time decreases the speed even further. Just adding 8MB (larger than L2 cache or any reasonable amount of SRAM to mount) of salt might be better than multiple hashings as well, plus it increases difficulty of mass-parallel processing. Multiple hashes are very L1 cache friendly when the input is tiny.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: