Using Random Slats to Prevent rainbow attacks.
What is a salt?
A salt is a random value added to a password before hashing it.
Instead of hashing just:
password123
We can Hash
password123+ random salt
Need for salting is necessary?
Yes Because hashes are deterministic:
Same input → same hash
Without a salt:
Understanding Rainbow table attack?
A rainbow table is a massive lookup table of:
common password → precomputed hash
If an attacker steals your password database:
Solution is Unique Salt per password:
Each user gets a different random salt:
Even though the password is the same:
An attacker would need:
A separate rainbow table for every salt Which is computationally infeasible.
Best Practices:
Important: Salt ≠ Secret