Why do I need to add the original salt to each hash iteration of a password?

Question

I understand it is important to hash passwords over multiple iterations to make things harder for an attacker. I have read numerous times that when processing these iterations, it is critical to hash not only the result of the previous hashing, but also append the original salt each time. In other words:

I need to not do this:

var hash = sha512(salt + password); 
for (i = 0; i < 1000; i++) {
    hash = sha512(hash); 
}

And instead, need to do this:

var hash = sha512(salt + password); 
for (i = 0; i < 1000; i++) {
    hash = sha512(salt + hash); 
}

My question is regarding the math here. Why does my bad example above make things easier for an attacker? I've heard that it would increase the likelihood of collisions but I am not understanding why.

Who says it is better? I’m not saying it isn’t, but maybe the context contains some argument? — Christopher Creutzig, Jan 08 '14 at 19:35
Can you provide a reference that says that you should prefer the second to the first? — templatetypedef, Jan 08 '14 at 21:18
[First Reference Thread](http://stackoverflow.com/questions/8717462/php-does-iterating-a-hash-make-it-more-secure), [Second Reference Thread](http://stackoverflow.com/questions/4948322/fundamental-difference-between-hashing-and-encryption-algorithms/4948393#4948393) — Justin Cooperman, Jan 08 '14 at 22:46
I personally don't think it matters (although I would probably use the second because why not) but maybe post in crypto.stackexchange instead. — Jeff, Jan 08 '14 at 22:53
This question is borderline since it is more about the security of the cryptographic algorithm than about its implementation. In any case, it has been [reposted](http://crypto.stackexchange.com/questions/12795/why-do-i-need-to-add-the-original-salt-to-each-hash-iteration-of-a-password) on [crypto.se]. — Gilles 'SO- stop being evil', Jan 08 '14 at 23:26
Considering that this is only on the reasoning of security behind a cryptographic construct, and that it has been cross-posted to Crypto.SE, this question should probably be closed. — B-Con, Jan 09 '14 at 16:38

score 0 · Answer 1 · edited Mar 17 '17 at 10:45

It is not that you simply need to do "hash = sha512(salt + hash)" - it's more complex than that. An HMAC is a better way of adding your salt (and PBKDF2 is based on HMAC - see below for more detail on PBKDF2) - there's a good discussion at When is it safe to use a broken hash function? for those details.

You are correct in that you need to have multiple iterations of a hash function for security.

However, don't roll your own. See How to securely hash passwords?, and note that PBKDF2, BCrypt, and Scrypt are all means of doing so.

PBKDF2, also known as PKCS#5v2 and RFC2898 is in fact reasonably close to what you're doing (multiple iterations of a normal hash function), particular in the form of PBKDF2-HMAC-SHA-512, in particular section 5.2 lists:

     For each block of the derived key apply the function F defined
     below to the password P, the salt S, the iteration count c, and
     the block index to compute the block:

               T_1 = F (P, S, c, 1) ,
               T_2 = F (P, S, c, 2) ,
               ...
               T_l = F (P, S, c, l) ,

     where the function F is defined as the exclusive-or sum of the
     first c iterates of the underlying pseudorandom function PRF
     applied to the password P and the concatenation of the salt S
     and the block index i:

             F (P, S, c, i) = U_1 \xor U_2 \xor ... \xor U_c

     where

               U_1 = PRF (P, S || INT (i)) ,
               U_2 = PRF (P, U_1) ,
               ...
               U_c = PRF (P, U_{c-1}) .

     Here, INT (i) is a four-octet encoding of the integer i, most
     significant octet first.

P.S. SHA-512 was a good choice of hash primitive - SHA-512 (and SHA-384) are also superior to MD5, SHA-1, and even SHA-224 and SHA-256 because SHA-384 and up use 64-bit operations which current GPU's (early 2014) do not have as much of an advantage over current CPU's with as they do 32-bit operations, thus reducing the margin of superiority attackers have for offline attacks.

Sure what you write is true, but the question was very specific about adding the salt in each iteration. The question was reposted on [crypto.stackexchange.com](http://crypto.stackexchange.com/questions/12795/why-do-i-need-to-add-the-original-salt-to-each-hash-iteration-of-a-password), have a look at the answers there. — martinstoeckli, Feb 26 '14 at 08:10

Why do I need to add the original salt to each hash iteration of a password?

1 Answers1