views:

40

answers:

2

I have a field in a row that I'm hashing and salting. The salt for each row is different. I decided to hash/salt a couple of more fields in each row.

Would using the same salt for those new fields in the same row make the data more susceptible to rainbow attacks compared to if I were to generate a new salt for each field? My logic is that it's only a couple of more fields in the same row that will use the same salt and it would make key/salt management much easier.

+1  A: 

Yes, but is the data really this important to use multiple salts? If you use one salt per row, this should be sufficient. For more salt-related info see this article: http://php-security.org/2010/05/26/mops-submission-10-how-to-manage-a-php-applications-users-and-passwords/

chiborg
+2  A: 

No, if someone has a rainbow table large enough to break you salt then you messed up by using a salt that is too small. Each byte you add to your salt makes the rainbow table exponentially larger. Adding a salt to your hash does not make a pre-computed attack impossible, only more difficult.

Re-use of a salt makes your system more prone to attack. An attacker can create an account, and then pull his salted hash out of the database using SQL Injection. Then he can brute force the salt (because he knows his own password) using John The Ripper. If the salt is stored in the database, then he can pull the salt and the hash using SQL injection and break the hash of an unknown password with John. If the password is a dictionary word it will take less than an hour to break.

Rook
+1 to Rook's comment. I blogged about same here- http://www.pivotalsecurity.com/blog/tips/password-hash-salt-should-it-be-random/
Gaurav Kumar