Unique salt for the user using Flask-Security

Question

After reading a little about salt passwords here, it seems that it is best to use a unique salt for each user. I am working on implementing Flask-Security atm, and from the documentation you can set the global salt: i.e. SECURITY_PASSWORD_Salt = 'thesalt

Question: How can I make a unique salt for each password?

Thanks!

edit: from the documents in Flask-Security I found this, which seems to suggest again that this module uses only one salt for all passwords out of the box.

flask_security.utils.get_hmac(password) Returns a Base64 encoded HMAC+SHA512 of the password signed with the salt specified by SECURITY_PASSWORD_SALT. 

Answer 1

Yes, Flask-Security does use salts for each user using bcrypt (and other schemes like des_crypt, pbkdf2_sha256, pbkdf2_sha512, sha256_crypt, sha512_crypt).

The configuration for "SECURITY_PASSWORD_SALT" is used only for HMAC encryption. If you use bcrypt as a hash algorithm, Flask-Security uses passlib for hashing and generates random salt during hashing. This statement is noted in release 268: https://github.com/mattupstate/flask-security/issues/268

This can be verified in the code, going from encryption to passlib:

flask_security / utils.py (lines 143-151, 39 and 269)

 def encrypt_password(password): ... return _pwd_context.encrypt(signed) _pwd_context = LocalProxy(lambda: _security.pwd_context) 

flask_security / core.py (269, 244-251 and 18)

 pwd_context=_get_pwd_context(app) def _get_pwd_context(app): ... return CryptContext(schemes=schemes, default=pw_hash, deprecated=deprecated) from passlib.context import CryptContext 

and finally from: https://pythonhosted.org/passlib/password_hash_api.html#passlib.ifc.PasswordHash.encrypt

note that each call to encrypt () generates a new salt,

Answer 2

It turns out that if you use bcrypt, it will take care of the salt and save it with a hash. Therefore, I will go along this route!

Thanks to this topic that will lead me to this discovery:

Do I need to store salt with bcrypt?