Hash - Password hashing and salting

Questions

I m trying to wrap my head around the logic of encrypting passwords with MD5/SHA combined with salting.

I understand the concept of a user proving a text password, and appending a random string (salt) to the text password, and hashing the final string via whatever encryption method you want.

This is where I lose the concept

Say in my database of users, I have usernames, and encrypted passwords generated with the random salt value

When the user goes to log into a system, and they enter their password, how do I obtain the correct salt to check the password validity?

If the salt is randomly generated to begin with, I can t recalculate it

Do I have to store the salt with the username/password record? If I query the database for the salt value by username, it would seem that defeats the purpose of having the salting.

How do I obtain the correct salt when it comes time to validate the supplied password?

Answers

http://en.wikipedia.org/wiki/Salt_(cryptography) http://en.wikipedia.org/wiki/Salt_(cryptography)

A new salt is randomly generated for each password. In a typical setting, the salt and the password are concatenated and processed with a cryptographic hash function, and the resulting output (but not the original password) is stored with the salt in a database

You store it with the hash, to prevent dictionary attacks.

Source

License : cc by-sa 3.0

http://stackoverflow.com/questions/27551118/password-hashing-and-salting

Related