Md5 hash + salt, how does salt help in password complexity?

Question

Hashing

If all possible combinations of up to 6 characters of hashes with md5 20 billion, then how will salt help in this regard? If just to check all these combinations + salt? Just need to create a new 20 billion hash table and that's it? After all, it's done in seconds. When brute-forcing large arrays, you will need to generate a hash table in a new way, okay. For each password - a new hash table of 20 billion, 10k passwords * 20 billion - is that a lot?

Answer 1

Just need to create a new 20 billion hash table and that's it? After all, it's done in seconds.

1. Even just allocating memory for 20 billion hashes will take far from seconds.
2. It won't take a second to burn them to disk.
3. Salt is needed so that it is impossible to use a PREVIOUSLY generated hash table.
4. md5 is not the best hash for today - you can use more laborious hashing, which will be generated more slowly.
In general, salt is needed precisely in order to provide resistance to rainbow tables. All.

Answer 2

Suppose we have a database of a million hashed unknown passwords, we want to iterate over a million password options to find them among the hashed ones.
If the hashes are not salted, then in a million password hashing operations we will find all suitable passwords in our database. Moreover, if we already have ready-made collections of hashes, then we won’t even count anything, we’ll just look for these hashes.
If the hashes are salted, then we will have to do a trillion password hashing operations for the same. Moreover, ready-made hash tables will not help us. By the way, there all passwords can be generally the same, but we won’t even see this, because the hashes will be different.
That is the general principle. We are not considering the issue of md5 vulnerability now, especially since you can salt with any hashing algorithm.