I'm using Rfc2898DeriveBytes in my application to encrypt a password with a randomly generated salt, and with a set iterator count for slowness.
Before, I just grabbed the generated salt and put it as a parameter for Rfc2898DeriveBytes to take care of, but now I've changed my approach to the following, and I'm wondering if it's doing more good, or more bad:
- Generate a random salt.
- Append the password to the salt.
- Hash the salt, using SHA-512.
- Pass the hashed salt to Rfc2898DeriveBytes, so it can do its magic.
I'm aware that any salt I provide to Rfc2898DeriveBytes, as long as it's unique/randomly generated, is considered a "true" salt, due to the nature of how the method operates. Does that mean that it'd be just as good as to pass the generated salt without any of the above modifications? (appending the password to it, and hashing it)
For informational purposes, the hashing algorithm Rfc2898DeriveBytes uses, is SHA512.
Rfc2898DeriveBytes
takes 3 arguments: A password, a salt and an iteration count. What stops you from providing exactly these three things as needed?