[BritZin]

Whilst working through a project, I've come across a pondering. I thought i'd ask the commuity, typically, if you're encrypting things, what do you use for an encryption salt? Do you use the data given as it's own salt:
E.g.

$password = "moocow" //From Form
$salt = sha1(md5($password));
$password = md5($password.$salt);

or do you use a random predefined one?
E.g.

$password = "moocow" //From Form
$salt = sha1(md5('aHdnie30834294ndahdnw'));
$password = md5($password.$salt);

Ignore the horiffic use of MD5
I'm enquiring for a general survey purpose to see how everyone else does it.

[Sam G]

Salt should always be dynamic. By the way - I hope you aren't using MD5 to encrypt your salt?

[skidz]

I'd use a mixture of RAND and UNIQID etc etc to give a dynamic salt! I'd also be using HASH instead of md5

[Gibbs]

I avoid creating a unique salt value as it has to be stored somewhere. I've never understood the logic of storing the salt value (as a column) in a database as it renders it useless should the database be breached. I usually use a value in the database such as the users email which can only be figured out with access to the file system.

[Sam G]

I use dynamic salts but I also don't store the entire password in the database (or in a file) - just certain portions of it.

[Jake151]

Hey

Sorry for what might be taking over the topic but I don't want to create a new one.

Regarding the dynamically created salts how do you create the same salt again so the user can say "log in" I have been looking into this technique for a while but am baffled by it. I have the thought that if the salt is dynamically created then you will not be able to get it back again or do you store it in the database as well? but then thats pointless because if the hacker sees it then they will know all the passwords.

I am quite confused if anyone can help.

Thanks a lot

Jake151

[skidz]

The salt would be encrypted (no backwards compatabilty) in the database as would the password so the chances of a hacker getting your dynamic encrypted salt and the encrypted password are very slim.

Especially if you were to use something like sha256 (as a totally over the top example).