Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

I use PBKDF2-SHA512 with an iteration count of 128,000 to hash my passwords. I use a CSPRNG to generate a salt per password. However, I am unsure about the ideal size of the salt. I have read a lot of things about the salt size, but I have been unable to find a definitive answer. All of them agree that there is a minimum salt size, but I have found nothing about a maximum salt size.

So, here's my question: is there a point where the salt size doesn't matter anymore in terms of security and where it might even decrease it? If there isn't a maximum salt size, does it mean that the size we choose is actually a sweet spot among performance/space for salt storage/protection against precomputed tables?

Thank you!

share|improve this question
    
A large amount of salt bits generated by the same PRNG that generates keys may in theory expose a weakness or bias in the PRNG that allows key recovery, in theory –  Richie Frame May 28 at 17:56

1 Answer 1

up vote 1 down vote accepted

So, here's my question: is there a point where the salt size doesn't matter anymore in terms of security and where it might even decrease it?

The purpose of a salt is to prevent the attacker from targeting multiple users' passwords with the same try or caching common passwords' hashes in a table. You need enough salts that each user has a unique salt. After that, having more won't help, nor will it hurt (within reason).

If there isn't a maximum salt size, does it mean that the size we choose is actually a sweet spot among performance/space for salt storage/protection against precomputed tables?

Basically, yes, although it's parallel attacks on your whole user database, rather than precomputed tables that I'd worry about.

However, there's definitely diminishing returns. If your salt is 64 bits you'd need a billion users before collisions are remotely likely. Double that to 128 bits and you can be pretty sure no one anywhere will use that same salt for any password hashing algorithm.

share|improve this answer
1  
@owlstead, 128 bytes would be fairly crazy. –  otus May 28 at 17:12
    
I was going to say that I would be worried about the size of all the salts put together, but with a million users and 128 bit salt you would have 16 MB worth of data - not that much IMHO. –  Maarten Bodewes - owlstead May 28 at 18:47
    
Or more generally, if you are going to store 256 bit password hashes, 128 bits of salt will add at most 50% to storage space. If 512 (why else use SHA-512?), 25%. –  otus May 29 at 7:16

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.