Concepts
Salting (and peppering)
Making every password hash unique
How it works
A salt is a random value generated for each password and stored alongside its hash. Because every user's salt is different, identical passwords produce different hashes and precomputed rainbow tables become useless. A pepper is an additional secret value kept outside the database, such as in an HSM or configuration secret.
Strengths
- Defeats rainbow tables and precomputation
- Hides which users share the same password
Weaknesses and known attacks
- A salt is not secret and does not slow down a targeted guess on its own
- Reusing one salt for every user removes most of the benefit
Use it for
- Every stored password hash (modern password hash functions do this automatically)
Don't use it for
- As a substitute for key stretching
Exam tip
Salt = unique, random, not secret, stored with the hash. Pepper = secret, stored separately. Rainbow table in the question = salting in the answer.