I use the
Rfc2898DeriveBytes for creating an AES key for protecting the user's data.
For the salt value I would like to use the user's id, which is a guid.
My understanding is, that the only drawback of using the user’s id would be, that it will get easier to crack keys which were previously built for this specific user, in case the attacker is in the posession of the database. But since the attacker has already cracked the current key, there is no need for cracking elder keys, therefore I don't see this as an issue.
Is it a problem to use the user’s id as a salt for the key derivation?
As an additional information, the guid is a Windows Sequential Guid. Therefore it is not really random but quite unique.