Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
In order to complicate rainbow table attacks, salt must be provided as input to PBKDF2 when a key is derived from a low-entropy password.
I have decided on my algorithms and key lengths to achieve certain bit strength. How long salt should I use for PBKDF2?
PBKDF2 defines, that the salt is concatenated with the numbers of iterations (in 32 bit big endian) as 2nd input to the PRF. If you use HMAC as PRF (as suggested in the wiki article), the 2nd argument can be of arbitrary length.
On other SE sites, you can find these questions and answers to cryptographic salts in general:
The main aspect of salts is that they are unique. So it comes down to how many different keys you want to derive with your KDF. As a rule of thumb, 32 or 64 random bits should be enough and you will most likely never exhaust those numbers. If you just want to derive a couple of keys from the master secret, you can get away with an even shorter salt, e.g. 2 byte. Even if you set the salt length "too short" and want to derive more keys later, you can always use the same salt and a different number of iterations. That will also result in different derived keys, because the number of iterations is embedded in the input of the first iteration of the PRF already.
