如何验证使用随机盐进行哈希处理的密码？

Question

I am developing a web application. Now from security perspective, salted hashing is required for the password while it is sent from client to server. Now my problem is, if I randomly generate a salt, append it to the password and hash the combination, how would this password be verified. As the salt generated is at random, hash of the salt+password combination would be different every time. If I send the same salt generated along with user credentials to the server, this will expose the salt. Exposed salt will create similar trouble as person trying to crack the password can append the exposed salt with different passwords to get the hash and match it. I have checked numerous websites and question on stack overflow but nothing matched my need exactly.

There are tools that can read the memory of browser and steal passwords entered. Therefore salted hashing is required at client side also.

Answer 1

You have to keep the salt on the server side of the code.

When you authenticate a user, you send the password to the server. The server appends the salt and then hashes the password. The salt should be stored somewhere in the serverside code or in the database.

You should never send the salt to the client side of the application.

Answer 2

There's no problem to keep the salt on database. The salt is only there to make sure an attacker don't use some table that has a lot of calculated hashs and its corresponding passwords to find out the passwords of your compromised database. With salt the only option for attackers is brute force.

So, to make it harder for attackers to brute force and find out the passwords from hashs I suggest a long and secure random salt for each user.

Good explanation can be found on Why do we use the "salt" to secure our passwords?