When a web service stores users' passwords, it adds a random value that differs for each user (a salt) to the password before computing and storing the hash value. What is the main purpose of the salt?

Answer: B. To make the stored hash values differ even when users share the same password, making cracking with tables of precomputed hash values difficult

The basic rule is not to store passwords as they are but to store hash values computed with a hash function. At login, the hash of the entered password is computed and compared with the stored value. If only plain hash values are stored, however, users with the same password have the same hash, and simply looking up a table of precomputed hashes of common passwords (such as a rainbow table) reveals many passwords. A salt is a value generated randomly for each user, added to the password and stored together with the hash. The salt does not need to be secret, but because it differs for each user, the same password gives different hash values and precomputed tables become useless. An attacker has to redo the computation for each user, which greatly increases the effort.

• A. A hash function cannot be reversed, so the password cannot be recovered even with the salt. Users who forget a password go through a reset procedure instead.
• B. Correct. The hash values differ per user, making cracking with precomputed tables difficult.
• C. Adding a salt does not change the length of the hash value; if anything, storing the salt increases the data stored.