SHA-512 crypt specs reports that SHA-512 crypt uses 128bit salt.
The FreeBSD/Linux password generation code builds the salt using 16 bytes random data (128bits) and then it translates the random data using something like the B64 encoding (which is a base64 variation).
An advisor is reporting that:
because of the cardinality of the subset, each character represents 6 bits of information. Having a salt of size 16 characters generated by this method gives 16x6 = 96 bits of pseudo random data.
In conclusion it looks like the salt of this implementation uses only 96 bits.
I don't agree with this because here the B64 is just used to have printable characters. The random values are used to pick up a valid character. Base64 encoded string grows in length, here we have the same length. The random string is then used as it is by the SHA-512 implementation (where it pass a 128 bit value).
Can somebody confirm the advisor statement and explain more?