What does hashing with salt protect against, and how do user hash and server hash match?

Question

Hashing with salt is a better approach for security. I want to know what kind of attack salting protects against, eg. eavesdropping.

Next, I want to know if the salt value is the same for the same password. Suppose that the server keeps the password and a ramdom salt. When the user want to login, it produce a ramdom salt and send the hash. In this manner, the hash from the server and the user have no way to match. Is my opinion right?

Salts help to reduce the attackability of passwords using computed hashes, they should vary for each hashed password. Try reading this post http://security.stackexchange.com/questions/103908/is-there-any-real-value-in-hashing-salting-passwords — iainpb, Dec 16 '16 at 10:05
All of these are already answered in other questions on this site - the top related questions for your question include http://security.stackexchange.com/questions/3272/password-hashing-add-salt-pepper-or-is-salt-enough?rq=1 and http://security.stackexchange.com/questions/51959/why-are-salted-hashes-more-secure-for-password-storage?rq=1 which answer most of these... — Matthew, Dec 16 '16 at 10:05

score 0 · Answer 1 · edited Mar 17 '17 at 13:14

I want to know what kind of attack salting protects against, eg. eavesdropping.

It protects against bruteforcing attacks. See this. Note that eavesdropping is something you worry about for data in transit - when it is sent between client and server. You hash password to protect data at rest - when it is stored on the server. (To protect passwords in transit - on their journey over the network from client to server - you use HTTPS. Bet that is another matter.)

Suppose that the server keeps the password and a ramdom salt. When the user want to login, it produce a ramdom salt and send the hash. In this manner, the hash from the server and the user have no way to match. Is my opinion right?

No, you are misunderstanding how password hashing is done. The client does not hash the password, so the user has no salt. So the problem of the salts not matching never arises.

Instead the client sends the passwod unhashed to the server. The server has one unique salt per password. That same salt is both used when originally hashing a new password for storage, and when checking passwords at login. That way, the hashes can be compared becuase the server used the same salt both times.

What does hashing with salt protect against, and how do user hash and server hash match?

1 Answers1