Search code examples
securitysalt-cryptographypassword-hash

Global site salt, is it worth it?

I'm making a user database and I was thinking about security and it just made me think, is it really worth it to have a site salt when I'm going to have unique user salts on everybody.

md5(GLOBAL_SALT . $password . $user_salt);

vs

md5($password . $user_salt);

My thoughts is if the site were to get hacked the hackers would have access to the global salt anyway.

Solution

  • What you are talking about is also called pepper. Salt and pepper have a different purpose:

    • The salt prevents from rainbow-table attacks.
    • The pepper can in some circumstances protect against dictionary attacks.

    It actually depends upon whether the attacker has control over the server, or has only acces to the database (SQL-injection), if a pepper is of use. I recently wrote a tutorial about hashing passwords, where i tried to explain the important points.

    There are other things to consider, like the fact that MD5 is ways too fast for password hashing, instead one should use a key derivation function like BCrypt.