1590
It should be noted that, despite common perceptions, the use of a good salt with a hash does not
sufficiently increase the effort for an attacker who is targeting an individual password, or who has a
large amount of computing resources available, such as with cloud-based services or specialized,
inexpensive hardware. Offline password cracking can still be effective if the hash function is not
expensive to compute; many cryptographic functions are designed to be efficient and can be
vulnerable to attacks using massive computing resources, even if the hash is cryptographically
strong. The use of a salt only slightly increases the computing requirements for an attacker
compared to other strategies such as adaptive hash functions. See CWE-916 for more details.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 916 Use of Password Hash With Insufficient Computational
Effort