Clarify the role of the salt about crypt_keeper HOT 8 CLOSED

Salting the master passphrase protects against pre-computed hash attacks. You can read more about it here PBKDF2.

Does that help?

from crypt_keeper.

@robotvert any other questions?

from crypt_keeper.

Well, I know what a salt is for. I know about rainbow tables and such.

Another benefit of the salt, as I wrote, is to prevent the data from "looking" the same even if 2 different records have the same data.
Hence my question: Isn't that salt's feature rendered useless by making it a shared value across all records?

from crypt_keeper.

No, it is not rendered useless.

On Apr 24, 2014, at 10:44 PM, Julien Feltesse [email protected] wrote:

Well, I know what a salt is for. I know about rainbow tables and such.

Another benefit of the salt, as I wrote, is to prevent the data from "looking" the same even if 2 different records have the same data.
Hence my question: Isn't that salt's feature rendered useless by making it a shared value across all records?

—
Reply to this email directly or view it on GitHub.

from crypt_keeper.

ok

from crypt_keeper.

@robotvert you're not wrong about salting the plaintext, but that is a much different issue. This deals strictly with the passphrase. You're never suppose to use the passphrase as the actual password, it's bad practice for the reasons I stated above. I highly recommending reading through the PBKDF2 article.

I also wanted to point out that most of the encryptors are utilizing random initialization vectors which means that the same plaintext encrypted multiple times yields different ciphertext. Here is an example below:

irb(main):009:0> c = CryptKeeper::Provider::AesNew.new(key: 'test', salt: 'test')
=> #<CryptKeeper::Provider::AesNew:0x007fe6c5a62b70 @key="a30964f784f3b5398d883f558f0c9aae8e12faaafdbd37c53512713421ae6e67e31fdfabee70c9013487c3788640f8af5940b08adc56a8b3153b7126e8c3c08a">
irb(main):010:0> c.encrypt('test')
=> "HcZ/kO4inzHn5pYyRoA7Nw==$2OGqpF3WtfAuxt8q0prK6g=="
irb(main):011:0> c.encrypt('test')
=> "LaotoV4DLRAGmRnNZojEOg==$IX7tosNripCc5yGGe++yOg=="
irb(main):012:0> c.encrypt('test')
=> "YKXoxdcqkPCBdKOmzhb81w==$tpYp/9BePZKm27poadKBYA=="
irb(main):013:0> 

I certainly do appreciate you voicing your concerns. Do you have any other feedback or thoughts?

from crypt_keeper.

Thanks for the explanation, it's much clearer now 👍

from crypt_keeper.

@robotvert no problem. I'm closing this issue out, if you need clarification on anything else, let me know.

from crypt_keeper.