Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

In my database, I have a column for the hashed password and the salt. My application allows users to change their password. Should I use the same salt for the password, or should I generate a new one? Does it matter to the security of the application?

share|improve this question

1 Answer 1

up vote 14 down vote accepted

Yes. Always generate a new salt when the password is changed.

Consider the following two scenarios:

Known not changing salt

I know you aren't changing the salt for your passwords. I see admin has a salt that is 'xyz', and now I grind out the rainbow table for that salt. Doesn't matter what you change your admin password to, I know it.

Repeated passwords

I know that the user had a hashed password of 'xyz:abcdef' (xyz is the salt, abcdef is the hashed password). Then later I see that the hashed information is 'xyz:012345' - ok, they changed their password. Yet later I see the hashed password as 'xyz:abcdef' and I know they've changed it back the first password.

These two scenarios where unnecessary information is given to the attacker is trivially avoided by generating new salt each time a password is generated.


You'll note that italics on the "when the password is changed" above. This was added after a comment by darkhogg asking if changing the salt more often is "better, worse, or just useless?"

On Security.SE the question of How often should I reset my salt? answers this. Changing the salt more frequently than the password changes gives a possible attacker more information about the password than just one hash.

Changing the salt more often than the password doesn't mean that an attacker will be more hindered by the new information because the same correct password will still work no matter what the salt is.

share|improve this answer
    
This might be enough for another question, but... Would changing the salt from time to time (say, 10-30 days) after a successful login be better, worse, or just useless? –  Darkhogg Mar 30 at 19:50
    
@Darkhogg that is indeed an interesting question and would probably be something to head over to Security.SE to ask. –  MichaelT Mar 30 at 20:26
3  
I think I just found my answer, I'll link it for completeness security.stackexchange.com/questions/39821/… –  Darkhogg Mar 30 at 20:42
    
@Darkhogg Thank you for the link, it was good reading. –  MichaelT Mar 30 at 23:11

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.