title: Block ciphers SALT: clear text or secret?
body: <p>There are many articles and quotes on the web saying that a 'salt' must be kept secret. Even the Wikipedia entry on <a href="http://en.wikipedia.org/wiki/Salt_(cryptography)" rel="nofollow noreferrer">Salt</a>:</p>
  
  <blockquote>
    <p>For best security, the salt value is
    kept secret, separate from the
    password database. This provides an
    advantage when a database is stolen,
    but the salt is not. To determine a
    password from a stolen hash, an
    attacker cannot simply try common
    passwords (such as English language
    words or names). Rather, they must
    calculate the hashes of random
    characters (at least for the portion
    of the input they know is the salt),
    which is much slower.</p>
  </blockquote>
  
  <p>Since I happen to know for a fact that encryption Salt (or Initialization Vectors) are OK to be stored on clear text along with the encrypted text, I want to ask <strong>why is this misconception perpetuated</strong> ?</p>
  
  <p>My opinion is that the origin of the problem is a common confusion between the encryption salt (the block cipher's <strong>initialization vector</strong>) and the hashing 'salt'. In storing hashed passwords is a common practice to add a nonce, or a 'salt', and is (marginally) true that this 'salt' is better kept secret. Which in turn makes it not a salt at all, but a key, similar to the much clearly named <strong>secret</strong> in <a href="http://en.wikipedia.org/wiki/HMAC" rel="nofollow noreferrer">HMAC</a>. If you look at the article <a href="http://www.aspheute.com/english/20040105.asp" rel="nofollow noreferrer">Storing Passwords - done right!</a> which is linked from the Wikipedia 'Salt' entry you'll see that is talking about this kind of 'salt', the password hash. I happen to disagree with most of these schemes because I believe that a password storage scheme should also allow for <a href="http://en.wikipedia.org/wiki/Digest_access_authentication" rel="nofollow noreferrer">HTTP Digest authentication</a>, in which case the only possible storage is the HA1 digest of the username:realm:password, see <a href="https://stackoverflow.com/questions/1000281/storing-password-in-tables-and-digest-authentication">Storing password in tables and Digest authentication</a>.</p>
  
  <p>If you have an opinion on this issue, please post here as a response.</p>
  
  <ol>
  <li>Do you think that the salt for block cipher encryption should be hidden? Explain why and <strong>how</strong>.</li>
  <li>Do you agree that the blanket statement 'salts should be hidden' originates from salted hashing and does not apply to encryption?</li>
  <li>Sould we include stream ciphers in discussion (RC4)?</li>
  </ol>