salts aren't relevant, if the attacker has the password database, they have the salt too.