In django user table password are encrypted automatically with a secure algorithm (pbkdf2_sha256) with salt and iterations. But what I don't understand is why the django password field shows the algorithm, iterations and salt in this format:
<algorithm>$<iterations>$<salt>$<hash>
I thought those information are secret and I want to show only the hash.
I thought those information are secret and I want to show only the hash.
It is secret in the sense that you should not expose this. But since a password can be hashed with different hashing algorithms that take a different number of iterations, and a different salt, you can not match the hashing with the password.
Indeed, when Django wants to check if the password matches, it will need to perform the exact same hashing (so the same algorithm, number of iterations and salt) to check if the two hashes are the same. Django thus needs this info to check the hash.
Note that here the salt is each time different, so by adding salt, the "search space" grows exponentially, and thus rainbow table attacks [wiki] are less successful. Furthermore as long as hashing is cheap in one way, but can only be determined through exhaustive search in the different direction, then hashing is a security measurement.
If one would not store the algorithm, number of iterations and salt per user, but simply store these things in a file, then we use the same algorithm with the same number of iterations and the same salt each time. In that case, a rainbow table attack can be more effective. By specifying random salt per record and with a , we let the "search space" grow exponentially with the length of the salt.
If the hashing algorithm is a one way function [wiki], then providing the parameters like the salt, algorithm and number of iterations will not suffice to calculate the function in reverse without exponential search, which is costly and easily scales beyond feasible with the current technology level.
