Security and Cryptography
 
Forums: » Register « |  User CP |  Games |  Calendar |  Members |  FAQs |  Sitemap |  Support | 
User Name:
Password:
Remember me

The Shed is going Social! Join us on FaceBook and Twitter and chime in on the conversation.

Go Back   Dev Shed ForumsSystem AdministrationSecurity and Cryptography

Reply
Add This Thread To:
  Del.icio.us   Digg   Google   Spurl   Blink   Furl   Simpy   Y! MyWeb 
Thread Tools Search this Thread Rate Thread Display Modes
 
Unread Dev Shed Forums Sponsor:
  #1  
Old August 28th, 2012, 10:00 AM
Jyncka's Avatar
Jyncka Jyncka is offline
We're trapped inside a game!
Dev Shed Newbie (0 - 499 posts)
 
Join Date: Jul 2008
Location: Maryland
Posts: 297 Jyncka User rank is Lieutenant General (80000 - 90000 Reputation Level)Jyncka User rank is Lieutenant General (80000 - 90000 Reputation Level)Jyncka User rank is Lieutenant General (80000 - 90000 Reputation Level)Jyncka User rank is Lieutenant General (80000 - 90000 Reputation Level)Jyncka User rank is Lieutenant General (80000 - 90000 Reputation Level)Jyncka User rank is Lieutenant General (80000 - 90000 Reputation Level)Jyncka User rank is Lieutenant General (80000 - 90000 Reputation Level)Jyncka User rank is Lieutenant General (80000 - 90000 Reputation Level)Jyncka User rank is Lieutenant General (80000 - 90000 Reputation Level)Jyncka User rank is Lieutenant General (80000 - 90000 Reputation Level)Jyncka User rank is Lieutenant General (80000 - 90000 Reputation Level)Jyncka User rank is Lieutenant General (80000 - 90000 Reputation Level)Jyncka User rank is Lieutenant General (80000 - 90000 Reputation Level)Jyncka User rank is Lieutenant General (80000 - 90000 Reputation Level)Jyncka User rank is Lieutenant General (80000 - 90000 Reputation Level)  Folding Points: 37258 Folding Title: Starter FolderFolding Points: 37258 Folding Title: Starter Folder
Time spent in forums: 5 Days 8 h 35 m 57 sec
Reputation Power: 902
Best practice with storing a salt

I'm building a project for work that has a login mechanism. I'd like to follow good practices as much as possible so I'll be using a per-user salt and hashing it with sha256 at the least. My question is on storing those salts. The easiest would be to store it in our database. At first my concern was that if someone got access to the database they would have access to the salts, but then again, they'd have access to everything else as well in that database. So I guess my question would be, is this a legitimately secure way to store these salts? It's not an overly complex application, it stores pretty basic info, first and last name, email address, maybe street address, no cc information, but I would like to be security-minded and be able to protect our users, just not sure of how far I should go.

Any advice would be great.
__________________
"Those who can make you believe absurdities can make you commit atrocities."

Reply With Quote
  #2  
Old August 28th, 2012, 04:04 PM
MrFujin's Avatar
MrFujin MrFujin is offline
Lord of the Dance
Dev Shed Loyal (3000 - 3499 posts)
 
Join Date: Oct 2003
Posts: 3,130 MrFujin User rank is General 11st Grade (Above 100000 Reputation Level)MrFujin User rank is General 11st Grade (Above 100000 Reputation Level)MrFujin User rank is General 11st Grade (Above 100000 Reputation Level)MrFujin User rank is General 11st Grade (Above 100000 Reputation Level)MrFujin User rank is General 11st Grade (Above 100000 Reputation Level)MrFujin User rank is General 11st Grade (Above 100000 Reputation Level)MrFujin User rank is General 11st Grade (Above 100000 Reputation Level)MrFujin User rank is General 11st Grade (Above 100000 Reputation Level)MrFujin User rank is General 11st Grade (Above 100000 Reputation Level)MrFujin User rank is General 11st Grade (Above 100000 Reputation Level)MrFujin User rank is General 11st Grade (Above 100000 Reputation Level)MrFujin User rank is General 11st Grade (Above 100000 Reputation Level)MrFujin User rank is General 11st Grade (Above 100000 Reputation Level)MrFujin User rank is General 11st Grade (Above 100000 Reputation Level)MrFujin User rank is General 11st Grade (Above 100000 Reputation Level)MrFujin User rank is General 11st Grade (Above 100000 Reputation Level) 
Time spent in forums: 2 Months 2 Weeks 1 Day 6 m 48 sec
Reputation Power: 1736
As you said, there is a lot more sensitive information than the password.

From my knowledge, one of the reason to use a salt is to prevent rainbow scan on the hashes and thereby get the clean-text password.

An expert will have to fill in the rest.

Reply With Quote
  #3  
Old August 28th, 2012, 10:33 PM
E-Oreo's Avatar
E-Oreo E-Oreo is offline
Lost in code
Click here for more information.
 
Join Date: Dec 2004
Posts: 7,946 E-Oreo User rank is General 91st Grade (Above 100000 Reputation Level)E-Oreo User rank is General 91st Grade (Above 100000 Reputation Level)E-Oreo User rank is General 91st Grade (Above 100000 Reputation Level)E-Oreo User rank is General 91st Grade (Above 100000 Reputation Level)E-Oreo User rank is General 91st Grade (Above 100000 Reputation Level)E-Oreo User rank is General 91st Grade (Above 100000 Reputation Level)E-Oreo User rank is General 91st Grade (Above 100000 Reputation Level)E-Oreo User rank is General 91st Grade (Above 100000 Reputation Level)E-Oreo User rank is General 91st Grade (Above 100000 Reputation Level)E-Oreo User rank is General 91st Grade (Above 100000 Reputation Level)E-Oreo User rank is General 91st Grade (Above 100000 Reputation Level)E-Oreo User rank is General 91st Grade (Above 100000 Reputation Level)E-Oreo User rank is General 91st Grade (Above 100000 Reputation Level)E-Oreo User rank is General 91st Grade (Above 100000 Reputation Level)E-Oreo User rank is General 91st Grade (Above 100000 Reputation Level)E-Oreo User rank is General 91st Grade (Above 100000 Reputation Level)  Folding Points: 945 Folding Title: Novice Folder
Time spent in forums: 2 Months 10 h 28 m 55 sec
Reputation Power: 7053
Salts are normally stored "next" to the passwords. They still serve their purpose even if they are known to the attacker.
__________________
PHP FAQ
How to program a basic, secure login system using PHP
Connect with me on LinkedIn


Quote:
Originally Posted by Spad
Ah USB, the only rectangular connector where you have to make 3 attempts before you get it the right way around

Reply With Quote
  #4  
Old November 2nd, 2012, 06:40 PM
jasonmoran jasonmoran is offline
Registered User
Dev Shed Newbie (0 - 499 posts)
 
Join Date: Nov 2012
Posts: 8 jasonmoran User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: 1 h 17 m 48 sec
Reputation Power: 0
Quote:
Originally Posted by E-Oreo
Salts are normally stored "next" to the passwords. They still serve their purpose even if they are known to the attacker.

I agree, most encryption tutorials don't attempt to "hide" the salt in any way so it's safe to store next to passwords

Reply With Quote
Reply

Viewing: Dev Shed ForumsSystem AdministrationSecurity and Cryptography > Best practice with storing a salt

Developer Shed Advertisers and Affiliates



Thread Tools  Search this Thread 
Search this Thread:

Advanced Search
Display Modes  Rate This Thread 
Rate This Thread:


Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
View Your Warnings | New Posts | Latest News | Latest Threads | Shoutbox
Forum Jump

Forums: » Register « |  User CP |  Games |  Calendar |  Members |  FAQs |  Sitemap |  Support | 
  
 


Powered by: vBulletin Version 3.0.5
Copyright ©2000 - 2013, Jelsoft Enterprises Ltd.

© 2003-2013 by Developer Shed. All rights reserved. DS Cluster - Follow our Sitemap