Hashes, passwords, and MACs
Understand salts and work factors
Use unique salts generated by the password library and tune cost parameters so identical passwords do not share a verifier and guesses remain expensive.
8 minute lesson
A salt is unique per password and does not need to be secret. Its job is to prevent precomputed and shared work.
Let the library generate and store the salt inside its encoded result. Tune memory and time cost to your environment, then increase them as hardware changes. Rehash after a successful login when a stored verifier uses an older policy.
Two users choose the same password. With a shared or missing salt, their stored verifiers match and one cracked password reveals the other immediately.
Unique salts stop shared precomputation but do not make weak passwords strong. Work factors still need periodic increases as hardware and service capacity change.
Hash the same password twice through the password library and save the two different encoded results. Verify both, then inspect where the algorithm, salt, and work factors are stored. Lower the policy cost for one test verifier and prove a successful login upgrades it without knowing or storing the plaintext later.
Lesson completed