I need to implement some hashing scheme for an open-source project. This is what I currently have and I'd like to hear whether this is secure enough -
The password is hashed using PBKDF2-SHA256 (which I prefer over bcrypt simply because OpenSSL supports it natively) with 2048 iterations.
The salt is actually a concatenation of two strings - the first one is unique and stored in the DB along with the password in plaintext. The second one is shared and stored in plaintext in the program's configuration file. My logic is that this will prevent brute forcing passwords if an attacker gains access to the DB but not to the server's filesystem.
Is this secure? Also how long should each part of the two salt strings be? 16+16 bytes? 32+32 bytes?