Bcrypt, what is meant salt and cost?

Question

I was always using MD5 for encrypting passwords, but I read that it's should no more be used, and instead use bcrypt..

I'm using zendframework 2 , where I found it describing bcrypt configurations as follows:

$bcrypt = new Bcrypt(array(
    'salt' => 'random value',
    'cost' => 11
));

what is the salt and what is the cost ? and how could them be used?

Answer 1

A salt is random text added to the string to be hashed. For example, you don't hash my_secret_password; you hash something like 1jfSLKe$*@SL$#)(Sslkfs$34:my_secret_password. The reason for this is that it makes it hard to set up a "rainbow table" to brute-force the passwords, even if the entire database of hashed passwords is stolen. If every password has a different salt, only the very weakest passwords (like "password" or "123456", which you should prohibit anyway) will be guessed.

A cost is a measure of how many times to run the hash -- how slow it is. You want it to be slow. Again, this is a redundant layer of security for if the hashed passwords are stolen. It makes it prohibitively expensive to brute-force anything.

You can read a good description here: https://security.stackexchange.com/a/51983/35405