Here is the text of the NIST sp800-63b Digital Identity Guidelines.

  • Laser@feddit.org
    link
    fedilink
    English
    arrow-up
    2
    ·
    2 days ago

    Salt the hash with something unique to that specific user so identical passwords have different hashes

    Isn’t that… the very definition of a Salt? A user-specific known string? Though my understanding is that the salt gets appended to the user-provided password, hashed and then checked against the record, so I wouldn’t say that the hash is salted, but rather the password.

    Also using a pepper is good practice in addition to a salt, though the latter is more important.