Timeline for How big should salt be?
Current License: CC BY-SA 3.0
7 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Apr 1, 2023 at 14:46 | comment | added | Jonathan | If uniqueness is their one job, a sequence number would offer more uniqueness than a random number since there is no chance of a conflict. | |
| Apr 21, 2021 at 20:49 | comment | added | Joshua Frank | When you say "a salt is not exactly the same as an Initialization Vector for symmetric encryption", can you explain a bit more why that is? This is something that I've been wondering about, since they seem to do the same thing. | |
| Jan 5, 2017 at 17:03 | comment | added | MickLH | 96 bits is still beautiful. | |
| Jan 5, 2017 at 17:01 | comment | added | MickLH | @SteveSether Inflating your password dictionary by 4 billion times is not so practical. Thus, even the hypothetical small salt has achieved the design goal of significantly increasing the attack complexity. | |
| May 1, 2015 at 16:59 | comment | added | Steve Sether | Salts must be far more than unique. Salts protect against making a rainbow table, or some other form of pre-computed attack. If you never would have more than 10,000 users, a salt of 32 bits would be sufficient. But yet it'd be trivial to pre-compute all the values of a 32 bit salt. | |
| Jan 31, 2012 at 14:30 | vote | accept | Hubert Kario | ||
| Jan 31, 2012 at 14:11 | history | answered | Thomas Pornin | CC BY-SA 3.0 |