I agree with Saxe. But if you must go with a global salt value (rather
weak) and storing in web.config then encrypt it first using DPAPI.
The developers sometimes argue performance to get their way!
The DPAPI solution will allow them to decrypt salt on startup (no DB
retrievals).
I have lost this battle many times but when I challenge the developer to
use the system APIs (DPAPI in this case) and show examples.. they cannot
dispute my solution.
-----Original Message-----
From: cynthia.peluso@us.ngrid.com [mailto:cynthia.peluso@us.ngrid.com]
Sent: Thursday, June 01, 2006 10:20 AM
To: webappsec@securityfocus.com
Subject: Salt Storage - web.config or database?
Where is the best place to store salts? I have developers that will be
using the Microsoft random number generator (ASP.NET ) to generate a
salt to append to the password and then hash. They want to store the
salt in the web.config file and the password hashes in the database.
What is best practice for salt storage? The developer's concern is
that storing the salts in the database will increase traffic volume. I'm
not sure if this is the case as we are talking 16 bytes or so. If
stored in web.config what level of protection is required?
Cindy
------------------------------------------------------------------------
-
Sponsored by: Watchfire
Watchfire named worldwide market share leader in web application
security assessment by leading market research firm. Watchfire's AppScan
is the industry's first and leading web application security testing
suite, and the only solution to provide comprehensive and consolidated
remediation task lists at every level of the application. See for
yourself.
Download a Free Trial of AppScan 6.0 today!
https://www.watchfire.com/securearea/appscansix.aspx?id=701300000007t9c
------------------------------------------------------------------------
--
-----------------------------------------
--
this email delivered by hermoth
-------------------------------------------------------------------------
Sponsored by: Watchfire
Watchfire named worldwide market share leader in web application
security assessment by leading market research firm. Watchfire's AppScan
is the industry's first and leading web application security testing
suite, and the only solution to provide comprehensive and consolidated
remediation task lists at every level of the application. See for
yourself.
Download a Free Trial of AppScan 6.0 today!
https://www.watchfire.com/securearea/appscansix.aspx?id=701300000007t9c
--------------------------------------------------------------------------
