Does salt size affect password hash security?

Question

I use PBKDF2-SHA512 with an iteration count of 128,000 to hash my passwords. I use a CSPRNG to generate a salt per password. However, I am unsure about the ideal size of the salt. I have read a lot of things about the salt size, but I have been unable to find a definitive answer. All of them agree that there is a minimum salt size, but I have found nothing about a maximum salt size.

So, here's my question: is there a point where the salt size doesn't matter anymore in terms of security and where it might even decrease it? If there is no maximum salt size, does it mean that the size we choose is actually a sweet spot among performance/space for salt storage/protection against precomputed tables?

Answer 1

So, here's my question: is there a point where the salt size doesn't matter anymore in terms of security and where it might even decrease it?

The purpose of a salt is to prevent the attacker from targeting multiple users' passwords with the same try or caching common passwords' hashes in a table. You need enough salts that each user has a unique salt. After that, having more won't help, nor will it hurt (within reason).

If there isn't a maximum salt size, does it mean that the size we choose is actually a sweet spot among performance/space for salt storage/protection against precomputed tables?

Basically, yes, although it's parallel attacks on your whole user database, rather than precomputed tables that I'd worry about.

However, there's definitely diminishing returns. If your salt is 64 bits you'd need a billion users before collisions are remotely likely. Double that to 128 bits and you can be pretty sure no one anywhere will use that same salt. With a sufficient number of users there's still a chance that someone, somewhere has used that salt value, so 256 bits would be an even more conservative choice. No use going beyond that, though.