Show what salting changes and what it does not

short · 30 min · Objective 1.4

Task

Demonstrate, with real hashes, that identical passwords produce identical digests without a salt and different digests with one — and then show that the salt does nothing at all against a weak password being guessed.

Steps

  1. Unsalted: printf 'Summer2026' | sha256sum twice, and again as a second 'user' with the same password. Note that all three digests are identical.
  2. Salted: generate two random salts with openssl rand -hex 16, then hash salt+password for each. Note that the digests now differ despite the password being the same.
  3. Write both results into /tmp/salt.md with a sentence saying what an attacker with a precomputed table can now do and cannot.
  4. Now show the limit. Write /tmp/guess.sh: a loop over a five-word list that includes your password, hashing each candidate WITH the known salt, and stopping when it matches.
  5. Run it and time it. The salt was known — salts are not secret — and the weak password fell immediately.
  6. Repeat the guess against a hash produced by a key-stretching function instead: openssl passwd -6 -salt abcdefgh 'Summer2026' uses many rounds. Note how the per-guess cost changes.

Verify

grep -c . /tmp/salt.md
bash /tmp/guess.sh | grep -ci "match"
python3 -c "
import hashlib,time
t=time.time(); [hashlib.sha256(b'x'+str(i).encode()).hexdigest() for i in range(200000)]
print('200k plain sha256 in %.2fs' % (time.time()-t))"

The third command is the point of the lab and is why it is not an echo: it puts a number on how cheap unstretched hashing is to guess against. Compare that figure with how long a single openssl passwd -6 took. Salting moved the attacker from a lookup table to a search; only stretching made the search expensive.

Notes

The sentence to carry out of this: salting defeats precomputation, stretching defeats speed, and neither saves a password that appears in a five-word list. That is why the modern guidance in Domain 4 is length plus a banned-password screen rather than complexity rules.

This is an independent study companion for CompTIA Security+ SY0-701 and is not produced by or endorsed by CompTIA.