Regularly re-salting and re-hashing stored passwords—changing the salt and computing a new hash for the same password—does not significantly enhance security and may introduce unnecessary complexity.
Understanding Salting and Its Purpose
Salting involves adding a unique, random string (the salt) to a password before hashing it. This ensures that even if two users have the same password, their hashed values differ due to distinct salts. Salting primarily serves to:
-
Prevent Rainbow Table Attacks: Attackers use precomputed tables of hash values to crack passwords. Unique salts make these tables ineffective, as each password hash becomes unique.
-
Ensure Unique Hashes: Identical passwords result in different hashes, preventing attackers from identifying common passwords in a database.
Evaluating the Practice of Re-Salting
Once a password is salted and hashed securely, re-salting it periodically offers minimal security benefits:
-
Limited Impact on Security: If an attacker gains access to the hashed passwords, having multiple hashes of the same password with different salts doesn't significantly increase security. The attacker can still attempt to crack each hash individually.
-
Unchanged Attack Complexity: Re-salting doesn't increase the computational effort required for an attacker to crack a single password hash. The primary defense remains the strength of the hashing algorithm and the complexity of the password itself.
Potential Risks and Considerations
Introducing regular re-salting can lead to:
-
System Complexity: Implementing periodic re-salting adds complexity to the authentication system, increasing the potential for errors.
-
Consistency Issues: Ensuring that password hashes remain consistent across distributed systems or during synchronization processes becomes more challenging with frequent re-salting.
Recommended Best Practices
Instead of focusing on re-salting, consider the following practices to enhance password security:
-
Use Strong Hashing Algorithms: Employ algorithms like bcrypt, scrypt, or Argon2, which are designed to be computationally intensive, thereby slowing down brute-force attacks.
-
Implement Unique Salts: Generate a unique, random salt for each password when it's first created or changed.
-
Encourage Strong Passwords: Promote the use of complex and lengthy passwords among users to increase resistance against attacks.
-
Monitor and Update Hashing Strategies: Stay informed about advancements in cryptography and update your hashing methods as needed to address emerging threats.
