8
$\begingroup$

I use PBKDF2-SHA512 with an iteration count of 128,000 to hash my passwords. I use a CSPRNG to generate a salt per password. However, I am unsure about the ideal size of the salt. I have read a lot of things about the salt size, but I have been unable to find a definitive answer. All of them agree that there is a minimum salt size, but I have found nothing about a maximum salt size.

So, here's my question: is there a point where the salt size doesn't matter anymore in terms of security and where it might even decrease it? If there is no maximum salt size, does it mean that the size we choose is actually a sweet spot among performance/space for salt storage/protection against precomputed tables?

$\endgroup$
1
  • 1
    $\begingroup$ A large amount of salt bits generated by the same PRNG that generates keys may in theory expose a weakness or bias in the PRNG that allows key recovery, in theory $\endgroup$ May 28, 2014 at 17:56

1 Answer 1

7
$\begingroup$

So, here's my question: is there a point where the salt size doesn't matter anymore in terms of security and where it might even decrease it?

The purpose of a salt is to prevent the attacker from targeting multiple users' passwords with the same try or caching common passwords' hashes in a table. You need enough salts that each user has a unique salt. After that, having more won't help, nor will it hurt (within reason).

If there isn't a maximum salt size, does it mean that the size we choose is actually a sweet spot among performance/space for salt storage/protection against precomputed tables?

Basically, yes, although it's parallel attacks on your whole user database, rather than precomputed tables that I'd worry about.

However, there's definitely diminishing returns. If your salt is 64 bits you'd need a billion users before collisions are remotely likely. Double that to 128 bits and you can be pretty sure no one anywhere will use that same salt. With a sufficient number of users there's still a chance that someone, somewhere has used that salt value, so 256 bits would be an even more conservative choice. No use going beyond that, though.

$\endgroup$
1
  • $\begingroup$ I was going to say that I would be worried about the size of all the salts put together, but with a million users and 128 bit salt you would have 16 MB worth of data - not that much IMHO. $\endgroup$
    – Maarten Bodewes
    May 28, 2014 at 18:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.