title: Why do we use the "salt" to secure our passwords?
body: <p>i was reading <a href="http://ruby.railstutorial.org/chapters/modeling-and-viewing-users-two#sec:secure_passwords" rel="noreferrer">this tutorial</a>, and i encountered the following discussion about encryption. At the end there's written </p>
  
  <blockquote>
    <p><strong>In the last line, we’ve hashed the salt with the password, yielding an
    encrypted password that is virtually
    impossible to crack</strong></p>
  </blockquote>
  
  <p>But in my opinion an hacker who has both the <code>encrypted_password</code> and the <code>salt</code> could do the "rainbow" trick exactly as if we were using the <code>salt</code>.</p>
  
  <p>So, where i'm wrong?</p>
  
  <p>Thanks!</p>
  
  <blockquote>
  <pre><code>$ rails console
  &gt;&gt; require 'digest'
  &gt;&gt; def secure_hash(string)
  &gt;&gt;   Digest::SHA2.hexdigest(string)
  &gt;&gt; end
  =&gt; nil
  &gt;&gt; password = "secret"
  =&gt; "secret"
  &gt;&gt; encrypted_password = secure_hash(password)
  =&gt; "2bb80d537b1da3e38bd30361aa855686bde0eacd7162fef6a25fe97bf527a25b"
  &gt;&gt; submitted_password = "secret"
  =&gt; "secret"
  &gt;&gt; encrypted_password == secure_hash(submitted_password)
  =&gt; true
  </code></pre>
    
    <p>Here we’ve defined a function called
    secure_hash that uses a cryptographic
    hash function called SHA2, part of the
    SHA family of hash functions, which we
    include into Ruby through the digest
    library.7 It’s not important to know
    exactly how these hash functions work;
    for our purposes what’s important is
    that they are one-way: there is no
    computationally tractable way to
    discover that</p>
    
    <p>2bb80d537b1da3e38bd30361aa855686bde0eacd7162fef6a25fe97bf527a25b
    is the SHA2 hash of the string
    "secret".</p>
    
    <p>If you think about it, though, we
    still have a problem: if an attacker
    ever got hold of the hashed passwords,
    he would still have a chance at
    discovering the originals. For
    example, he could guess that we used
    SHA2, and so write a program to
    compare a given hash to the hashed
    values of potential passwords:</p>
  
  <pre><code>&gt;&gt; hash = "2bb80d537b1da3e38bd30361aa855686bde0eacd7162fef6a25fe97bf527a25b"
  &gt;&gt; secure_hash("secede") == hash
  =&gt; false
  &gt;&gt; secure_hash("second") == hash
  =&gt; false
  &gt;&gt; secure_hash("secret") == hash
  =&gt; true
  </code></pre>
    
    <p>So our attacker has a match—bad news
    for any users with password "secret".
    This technique is known as a rainbow
    attack.</p>
    
    <p>To foil a potential rainbow attack, we
    can use a salt, which is a different
    unique string for each user.8 One
    common way to (nearly) ensure
    uniqueness is to hash the current time
    (in UTC to be time zone–independent)
    along with the password, so that two
    users will have the same salt only if
    they are created at exactly the same
    time and have the same password. Let’s
    see how this works using the
    secure_hash function defined in the
    console above:</p>
  
  <pre><code>&gt;&gt; Time.now.utc
  =&gt; Fri Jan 29 18:11:27 UTC 2010
  &gt;&gt; password = "secret"
  =&gt; "secret"
  &gt;&gt; salt = secure_hash("#{Time.now.utc}--#{password}")
  =&gt; "d1a3eb8c9aab32ec19cfda810d2ab351873b5dca4e16e7f57b3c1932113314c8"
  &gt;&gt; encrypted_password = secure_hash("#{salt}--#{password}")
  =&gt; "69a98a49b7fd103058639be84fb88c19c998c8ad3639cfc5deb458018561c847"
  </code></pre>
    
    <p><strong>In the last line, we’ve hashed the salt with the password, yielding an
    encrypted password that is virtually
    impossible to crack</strong>. (For clarity,
    arguments to hashing functions are
    often separated with --.)</p>
  </blockquote>