Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Why should a salt have the same length as the hashed value? [closed]

I've have read that a salt that is going to be used should have the same length as the hashed password, what is the reasoning behind this? Will it increase password protection? I have read it Here:

To make it impossible for an attacker to create a lookup table for every possible salt, the salt must be long. A good rule of thumb is to use a salt that is the same size as the output of the hash function. For example, the output of SHA256 is 256 bits (32 bytes), so the salt should be at least 32 random bytes.

like image 500
user962206 Avatar asked Dec 28 '12 03:12

user962206


1 Answers

Here is a good description of why password salts are needed.

No, you don't need your salt to be the same length as the password. In fact, none of the implementations listed in the article do that. Generally for each added bit of salt you're requiring an attacker to double his storage budget.

So having a 10 byte salt should be sufficient for today's level of technology. Also note that the salt is binary value whereas passwords are not, so the salt length should be measured in bits/bytes and not characters.

like image 101
Vlad Avatar answered Sep 28 '22 01:09

Vlad