Skip to main content

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

6
  • If its a password that the user has to enter, store the hash+salt of the password. See answer below. Commented Oct 30, 2009 at 9:23
  • 1
    @hapalibashi: How do you store the salt securely in your application? I don't think the OP needed a one-way password matching system, just a generalized way of storing static keys. Commented Oct 30, 2009 at 9:38
  • 2
    I've found when looking at disassembled programs there typically aren't very many XORs, so if you're hoping to use XOR to obscure something, keep in mind they draw attention to themselves. Commented Nov 1, 2009 at 20:09
  • 2
    @kb - that's an interesting point. I'd guess you'd see bitwise ands and ors happening a lot more than xor. a ^ b == (a & ~b) || (~a & b) Commented Nov 2, 2009 at 17:26
  • 4
    Knowing the salt value doesn't usually give an adversary an advantage - the point of the salt is to avoid a "dictionary attack", whereby the attacker has pre-computed the hashes for many likely inputs. Using a salt forces them to pre-compute their dictionary with a new one based on the salt. If each salt is used only once, then the dictionary attack becomes completely useless. Commented Jul 5, 2012 at 14:19