Hi, This I understand. What I mean is this: If each salt is unique, your passwords will never match as between generation and comparison, they will have to be different! In very simplified pseudocode: Making the salted password
$salt = generateRandomSalt();
//The function returned 159
$pwd = md5('password');
//$pwd = 12345678901234567890123456789012
writeToDb($salt + $pwd);
Checking the salted password:
$salt = generateRandomSalt();
//This time the function returned 246
$pwd = md5('password');
//$pwd = 12345678901234567890123456789012
//compare
//12312345678901234567890123456789012 and
//24612345678901234567890123456789012
//Not looking good...
if(($salt + $pwd) == getStoredPasswordFromDB()) then
win();
else
fail();
endif
As the generated salt will always be random, the salt will always be different for each call, so... if both passwords are different, how do you validate it? In this example with a random salt, the checking condition will always fail, and if you store the salt (or even store the method of generating a unique salt per user), then you are pwned just as bad, it will just take some extra time to reverse engineer the login system, and from there, back to some form of rainbow tables once the salt part is understood and removed. Can someone light my candle here? My area of expertise is PHP along with Classic VB & VBA, so a .NET library is not much use, but really, it's the idea of just how this really works, as I am already sold on the need of such a system! Cheers!