Download eBook (PDF) - Red Gate Software

7 – One-Way EncryptionReducing Vulnerability: Salting a HashIn culinary circles, salt is used as a preservative and a flavor enhancer. In thedays before refrigeration meat was heavily salted for extended storage. The saltslowed the deterioration of the meat and prevented mold and bacteria fromcontaminating it. This protected the integrity of the meat so that its qualitycould be assured for a reasonable length of time.Salt in cryptography has a similar effect. A one-way encrypted hash value isvulnerable to dictionary and rainbow table attacks; but adding a salt to the plaintext, before it is encrypted, results in a hash value that is very resilient to theseattacks. Salting renders the underlying plain text more complex, and breaksexpected patterns that can be anticipated by the attacker.For example, an attacker who is executing a dictionary attack against a tablethat contains unsalted hash values of Social Security Numbers will anticipatethat the patterns of the plain text will be "000-00-0000" or "000000000". Thisknown pattern provides the attacker with a finite combination of approximatelyone billion (10 9 ) possible values. However, if the Social Security Number issalted with a seven character alphanumeric value, for example, then thepossible combinations for the plain text values skyrockets to over seventy eightquintillion (78 x 10 18 ). Therefore, salting is a highly effective way ofstrengthening one-way encryption.In the HomeLending database we will create a scalar-valued user definedfunction, called GetHashSalt, which is designed to return a seven charactervalue, which will be used as the salt portion of a one-way encryption process.Scalar-valued user defined function:… is a function in which the value that is returned from its execution is asingle valueListing 7-1 shows the script to create our GetHashSalt function. We willoffer six variations of salt values designated with the values "L01" through"L06". These variations will provide a deeper level of protection to items thatare salted throughout our database. These are the values that will be passedthrough the @Type argument of this user defined function.Use HomeLending;GOCREATE FUNCTION GetHashSalt(@Type varchar(3)155