One way functions, Hash algorithms

Question

Basically One-way functions have two properties: 1. Irreversible 2. Collision-Resistance(which means no two same words have the same hash value correct me if im wrong)

On the other hand i see that Salted Hash Passwords are used to provide more security to hash values of passwords and also provide collision-avoidance to passwords which have the same plain value.

So why does this happen, aren't hash functions supposed to have Collision-Resistance, why does Salt have to provide this when hash functions already have that property?

Thank you in advance.

Answer 1

It would be wonderful if one-way hash functions were really one-way.

What happens if two users choose the same password? Without salt, they get the same hash.

Guess what? People are not good at choosing passwords. These creatures of limited memory and lacking in natural internal cryptographic randomness often choose passwords that are short, low entropy, and brute-forceable.

If you want to crack the hash of a password that didn't involve salt, then just Google it.

Salt helps fix the problem, but it is not the panacea. With salt, two people who choose the same password do not get the same password hash, assuming the salt is different for both users. Salts also help prevent rainbow table attacks, which is a time-memory trade-off to hack out passwords.

Still, this does not solve all problems. If your database becomes public, salt + cryptographic hash is not enough because attackers can still brute force-passwords using low cost GPUs.

So what is the solution? You not only need salt, but you also need brute forcing to be a slow process. That's why we don't use hash functions for passwords, instead we use password hashing functions. Don't blame me for the stupid terminology, I fully agree. Bottom line: choose from bcrypt, scrypt, argon2, pbkdf2. I personally recommend bcrypt.

Answer 2

Just want to add a detail to @TheGreatContini s answer.

1. For passwords hashed without a salt, you will probably find an already prebuilt rainbow-table.
2. If you use a single salt for all passwords, an attacker has to build 1 rainbow-table using this salt, to get all passwords.
3. If each password gets its unique salt, an attacker would have to build a rainbow table for each password. Building a full rainbow-table to only get 1 password doesn't make sense, that's why we can say that unique salt prevents rainbow table attacks.