rspec/rules/S2053/rationale.adoc
2023-07-06 10:32:19 +02:00

16 lines
963 B
Plaintext

During the process of password hashing, an additional component, known as a
"salt," is often integrated to bolster the overall security. This salt, acting
as a defensive measure, primarily wards off certain types of attacks that
leverage pre-computed tables to crack passwords.
However, potential risks emerge when the salt is deemed insecure. This can occur
when the salt is consistently the same across all users or when it is too short or predictable.
In scenarios where users share the same password and salt, their password hashes
will inevitably mirror each other. Similarly, a short salt heightens the
probability of multiple users unintentionally having identical salts, which can
potentially lead to identical password hashes. These identical hashes streamline
the process for potential attackers to recover clear-text passwords. Thus, the emphasis on
implementing secure, unique, and sufficiently lengthy salts in password-hashing
functions is vital.