Do I need to Salt an password that has been hashed using scrypt?

Question

I am storing passwords in a database at the minute, by using an scrypt algorithm and then storing that string.

I am then doing the password check, by then hashing the password provided, and checking it against that.

My question is, do I want to be adding more security than that? Should I be salting the encrypted string, too?

Answer 1

No, scrypt by definition includes a salt in its hashing procedure to prevent rainbow attacks already. Meaning an additional salt would not give you any security benefits. Additional tinkering will only complicate your code and make your system more brittle.