When storing user credentials in a database, we all know that hashing the password is the bare minimum you should do, but salting it before hashing is better. The salt should be randomly generated, long enough, and unique for each user.
I remember reading somewhere (but I don't remember where) an article about using two salts (both long enough and randomly generated) :
- One global salt
- One unique-per-entry salt
The resulting hash would be :
hash(globalSalt + password + uniqueSalt) (the order of concatenation is not really important).
Is there any reason why this would be more secure than simply having one unique salt per entry ? We suppose that the attacker has access to the code files where the global salt is stored.