Salt (cryptography)

In cryptography, a salt is an additional input fed to hash functions. This is done to prevent rainbow table attacks. Ordinarily, every string of data produces the same hash every time assuming the same function is used (MD5, SHA256, etc.), but with a salt added, identical inputs will produce different outputs assuming a different salt is used. An ideal length for a salt is 16 bytes.

Etymology

The exact etymology of salt is disputed. Some say it comes from cooking. Salt is added to food to give it extra flavor, and cryptographic salts are added to hash inputs to give them extra security. Others say it comes from the phrase "salting the earth." Pouring salt on the ground makes it impossible for plants to grow there, and adding a salt to a hash input makes the output useless to attackers trying to reverse engineer it.

Uses

Salts are often added to passwords and passphrases to increase security. Without a salt, the same password produces the same hash every time, so if two users have the same password, they have the same hash. Typically, each password has a random, unique salt. The salt is concatenated with the password or passphrased, and they are hashed together. The salt and hash are both stored in the database. The salt is stored in plaintext because it is useless on its own to attackers.

On imageboards

Salts are used to create secure tripcodes, the tripcodes that are created when you use two pound signs instead of one when tripfagging. This allows secure tripcodes to be unique between imageboards and prevents tripcodes from being reverse-engineered. 4chan's secure tripcode salt was leaked during the Great Cuckset.