Salting passwords, how to store the salt in the DB?

[msaz87]

I'm incorporating a dynamic salt into my user system, but I'm not sure how to store the salt itself. The password is hashed and added to the database, but wouldn't you need to store the salt as plain text in the database in order to verify the login later?

 

Also, I've read that using both a dynamic and static salt is good practice. If this is the case, is the static salt simply defined within the PHP? Or is there another method to storing it?

 

Thanks for the help

[melloorr]

You should check my thread:

http://www.phpfreaks.com/forums/index.php?topic=348885.msg1646220#msg1646220

[scootstah]

I'm incorporating a dynamic salt into my user system, but I'm not sure how to store the salt itself. The password is hashed and added to the database, but wouldn't you need to store the salt as plain text in the database in order to verify the login later?

 

You just store the salt in the database. Its only purpose is to make two identical passwords have different hashes. Even if the database is compromised and the salt exposed, its job is still done.

 

Also, I've read that using both a dynamic and static salt is good practice. If this is the case, is the static salt simply defined within the PHP? Or is there another method to storing it?

 

Thanks for the help

 

This is called a pepper. It is just defined in a PHP file somewhere, like in a config file or something. Unless someone actually gains access to the file system, this cannot be discovered.

[msaz87]

Thanks! The answers definitely clear up my confusion.