Why is saving the salt for a hashed password in the same database secure?
.net, cryptography, hash, salt
Solution
This is secure because having access to the salt does not make the process of hashing any easier to reverse for an attacker. Given the password, the salt, and the hash, you can quickly check if the triple is right. However, you cannot use the knowledge of the salt to help you get the password.
Recall that the reason the salt is needed in the first place is to avoid equal passwords produce equal hashes. Without the salt, attackers would be able to hash the "rainbow table", and check hashes against the encoded dictionary.
Problem
I understand the need for hashing and salting, but I do not understand how storing the salt in the same (potentially compromised) database as the entire hash is secure. For example, a book I'm studying instructs to create a unique hash for each user (good) by randomly generating an integer and creating a byte[] using the RNGCryptoServiceProvider. That is all well and good, but in order to validate a user's password upon login, it will be necessary to read that unique salt from the database (or some other file). Is this a secure way of storing a salt?