# Hiding salt with C

**URL:** <https://www.ruby-forum.com/t/hiding-salt-with-c/66531>\
**Category:** Ruby\
**Created:** [August 26, 2006, 4:46pm UTC](https://www.ruby-forum.com/t/hiding-salt-with-c/66531 "2006-08-26T16:46:51Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Cliff\_C](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/67e7ee/32.png) [@Cliff\_C](https://www.ruby-forum.com/u/Cliff_C)\
**Post date:** [August 26, 2006, 4:46pm UTC](https://www.ruby-forum.com/t/hiding-salt-with-c/66531/1 "2006-08-26T16:46:51Z")

</div>

Does anybody know of an existing C extension that interfaces with ruby  
code for the sole purpose of hiding important encryption info, such as  
the SALT? When users write encrypt/decrypt methods it would be nice to  
call a C interface to obtain the salt/iv. This way general users would  
have a harder chance of cracking the encryption. Using this method  
wouldn’t about the only way to obtain the sensitive data by reading each  
RAM address and try to grab the value while that Ruby method executes  
while it’s calling the C extension.

If one doesn’t exists is this something other users would take advantage  
of if one was written?

Look forward to all the suggestions!

---

<div class="post-metadata">

**Author:** ![Cliff\_C](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/67e7ee/32.png) [@Cliff\_C](https://www.ruby-forum.com/u/Cliff_C)\
**Post date:** [August 27, 2006, 4:30am UTC](https://www.ruby-forum.com/t/hiding-salt-with-c/66531/2 "2006-08-27T04:30:27Z")

</div>

On 8/26/06, Cliff C. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> of if one was written?
> 
> Look forward to all the suggestions!

I would suggest just compressing your salt and using zlib to  
decompress – do the operations in two different places. You only  
store the compressed version in your code. You could further hide the  
salt by using a bit of some part of your code or other reflective  
“stuff” and just using the compressed version as the salt. Wrapping it  
in a so will not be much stronger.

pth

---

<div class="post-metadata">

**Author:** ![Cliff\_C](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/67e7ee/32.png) [@Cliff\_C](https://www.ruby-forum.com/u/Cliff_C)\
**Post date:** [August 27, 2006, 5:22am UTC](https://www.ruby-forum.com/t/hiding-salt-with-c/66531/3 "2006-08-27T05:22:55Z")

</div>

The salt doesn’t need to be secret. The whole point of modern  
encryption methods is that only the secret keys need be hidden. The  
only point of a salt is to ensure that if the same data is hashed by  
two different services the result will be different and there is no way  
to tell that they came from the same data. You can publicly display it  
to the world as long as it is different from that of other services.