[Haskell-cafe] Password hashing

John Meacham john at repetae.net
Tue Nov 25 20:08:01 EST 2008

What you are using there is not a salt, but rather a secret key. The
important thing about a salt is that it is different for _every user_.
and you actually store the salt unhashed along with the hash. (it is not
secret information). A salt protects against a dictionary attack, for
instance, you might have a dictionary of hash's and the common passwords
they go to but if you add a 32 bit salt, you would need 2^32 entries for
each dictionary word, making such an attack unworkable. You can also
trivially tell if two users have the _same_ password just by comparing
the hashes without a salt.


John Meacham - ⑆repetae.net⑆john⑈

More information about the Haskell-Cafe mailing list