Home/ Questions/Q 8125459
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-06T06:49:30+00:00

My question is this: Doesn’t storing the salt as plaintext defeat the purpose of

  • 0

My question is this:

Doesn’t storing the salt as plaintext defeat the purpose of having a
salt (which I’ve heard is fine to do)? I was of the impression that the salt is meant to be an additional variable providing added
complexity for a brute-force or dictionary attack, by causing any attempt to convert the correct password to the key to fail unless thecorrect salt is supplied. It seems to me that if the salt is known, the attacker can try each password with the correct salt. If not, why?

Thanks in advance for taking the time to answer my questions.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    The point of a salt is to prevent an attacker from reusing his dictionary for multiple ciphertexts.
    There is nothing wrong with revealing the salt.

    Instead, you should make sure that your salt is never re-used by a different ciphertext.
    To do that, you should create salts using a secure random number generator.

    • 0