This, I think, may be a stupid question, but I am very confused about what I have to do here for the best.
When stuffing a password hash, if the salt should also be hashed or left in clear text?
NOTE. I use a password in SHA-256, and Salt is a predefined string, since only one password will be stored at a time.
TIA
Chris (Shamballa).
It does not matter.
The purpose of salt is to prevent attacks before calculating.
, , . , , , . , , . , , .
, .
, - . , . , .
, . , . , .
, ( ), . - . , , . .
, , -, .
, -, , .
, , .
, . , , .
, :
SaltedHashedPwd = H (H (H (H (..... H (PWD-k + SALT-k) + SALT-k) + SALT-k).....) + SALT-k + N
H - - SALT-k - k- , PWD-k - k- ( ) N - , H
PKCS # 5 N = 1000!
manne , SALT Hash. !
, N = 100 : -)
(, , ), , . , ( , ). , , , , , ( -), ( ) , . , , , .
(If someone sees an error in this logic, please comment.)