Intermediate LevelWeb Security & Cyber Defense
What is the difference between a Salt, Nonce, and Initialization Vector (IV)?
❓ Interview Prompt: Compare Cryptographic Salt (password hashing), Nonce (number used once, replay defense), and Initialization Vector (IV, AES cipher randomness).
Differentiating random values in cryptography:
•
Salt (Password Hashing): Random string appended to a password before hashing ('hash(password + salt)'). Prevents pre-computed Rainbow Table attacks and guarantees two users with identical passwords have different hashes.
•
Nonce (Number Used Once): Unique value used once in an interactive protocol (e.g. OAuth/TLS) to prevent Replay Attacks.
•
Initialization Vector (IV): Random seed value passed to block ciphers (AES-GCM). Ensures that encrypting the exact same plaintext twice produces completely different ciphertexts!
Code Implementation Example
typescript
import crypto from 'crypto';
// Generate random Salt, Nonce, and IV
const salt = crypto.randomBytes(16).toString('hex'); // 16 bytes for password hashing
const iv = crypto.randomBytes(12); // 12 bytes for AES-256-GCM cipher
const nonce = crypto.randomBytes(16).toString('base64url'); // Single-use nonce💡Generating Cryptographic Salt, IV, and Nonce in Node.js.
🎯 Interview Key Takeaway
Salts protect password hashes; Nonces prevent replay attacks; IVs ensure identical plaintexts encrypt to different ciphertexts.
#Cryptography#Salt#Nonce#IV#Intermediate
Back to all Web Security & Cyber Defense Questions→