Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

> the password is hopefully accompanied by a salt, each of which sit in their own columns

Question: there's no real reason for the hash to be in a separate column, correct? Just that it's different per record?



Correct. Many hashing functions designed for password hashing build the salt directly into the output string, in order to make it difficult to accidentally hash passwords without using a salt. On the other hand, if you're just using a bare hash function, you may find it convenient to store the salt in a separate column, if only to save yourself having to split on a separator character / character length in your application logic.


Yeah, that's what I was I thinking. Bcrypt does that, or at least the implementation I'm familiar with seeing in Rails. The sentence threw me off there for a second. Thanks for the clarification.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: