In my database, I have a column for the hashed password and the salt. My application allows users to change their password. Should I use the same salt for the password, or should I generate a new one? Does it matter to the security of the application?
- Anybody can ask a question
- Anybody can answer
- The best answers are voted up and rise to the top
Yes. Always generate a new salt when the password is changed.
Consider the following two scenarios:
Known not changing salt
I know you aren't changing the salt for your passwords. I see
I know that the user had a hashed password of 'xyz:abcdef' (
These two scenarios where unnecessary information is given to the attacker is trivially avoided by generating new salt each time a password is generated.
You'll note that italics on the "when the password is changed" above. This was added after a comment by darkhogg asking if changing the salt more often is "better, worse, or just useless?"
On Security.SE the question of How often should I reset my salt? answers this. Changing the salt more frequently than the password changes gives a possible attacker more information about the password than just one hash.
Changing the salt more often than the password doesn't mean that an attacker will be more hindered by the new information because the same correct password will still work no matter what the salt is.