What is the difference between hash salting and noncing?
SecurityHashCryptographySecurity Problem Overview
I have read up on these two topics, and I can't seem to quite grasp the difference between salting and noncing hashes.
Security Solutions
Solution 1 - Security
A salt is a non-secret, random value that's used to ensure that the same plaintext will not consistently hash to the same output value; it's used to prevent precomputation attacks such as Rainbow Tables.
A nonce ("number used once") is a - typically randomly generated - value that's associated with a message in a cryptographic scheme, and must be unique within some specified scope (such as a given time interval, or a session). It's typically used to prevent replay attacks.
Nonces and salts are similar and serve related purposes, but aren't identical. Both are typically randomly generated, not secret, and serve to prevent attacks that would otherwise be possible against the system. They differ mainly in the context in which they're used, and in the consequences of repeats - a duplicate salt is unimportant, but a duplicate nonce can have dire consequences.
Solution 2 - Security
nonce = number used once. If you generate a unique salt for each bit of data you're hashing, then it's essentially a nonce as well.
Solution 3 - Security
Hashing is one way process unlike Encryption(using a key we can decrypt). Fixed size and Slight changes in data produces entirely new hash value. It is like finger print. Example: MD5,MD6,SHA-1,SHA-2 and so on..
Storing password in database with hash format also not safe by Rainbow tables, Dictionary attacks and Brute force(GPUs can compute billions of hashes per second). To avoid these issue we need to use Salt.
A Salt(random number) is used so that the same password does not always generate the same key. i.e. A salt is simply added to make a common password uncommon.
A Salt is something we add to our hash to prevent rainbow attacks using rainbow tables which are basically just huge lookup tables that convert hashes to passwords as follows:
dffsa32fddf23safd -> passwordscrete
f32ksd4343fdsafsj -> stackoverflow
So hacker can find this rainbow table, to avoid this problem we have to store hash with the combination of password and salt.
hash= hashFunction(passowrd+salt)
A Nonce (Number used only once) does not need to be secret or random, but it must not be reused with the same key. This is used to prevent replay attacks (aka playback attack).