Search code examples
securitypassword-hashsalt-cryptography

Is salting passwords with base 64 secure?


In a web application I am reading some bytes from /dev/urandom to get a random salt for hashing the passwords.

Is it good to base64 the salt before hashing? Because base64 encoding sometimes appends some = at the end, which could then result in a known plaintext attack. But it may be no problem, because the salt is nevertheless stored in db, or am I wrong?

Does this have an effect on the security of the application?


Solution

  • For the most part, probably not. Your salt has to be known in order to decrypt the password, so we can assume that any attacker will be able to gain both the hashed password and the salt used. All that your salt is now protecting against is rainbow table-based attacks and increasing the amount of work (since each plaintext now needs to be hashed n times instead of once to compare against n passwords).

    As long as your salt is of a reasonable length, you're probably fine.