How high is the entropy of this salt-generating code? (No code-reading actually necessary)

What is the best method?

Assumption: I have a function that generates a number of medium-high entropy bytes

• Step1: I generate 3 of these medium-high entropy bytes.

• Step2: I hash these bytes using a known crypto-strong algorithm (sha256)

• Step3: I cut a substring from the result.

• Step4: I use this string as my salt (3 byte salt)

So, I can do:

• Step1 and 4;

• 1, 2, 3, and 4;

• 1, 3, and 4; etc.

The question is which of these operations increases entropy, and which does not?

Some code:

``````function delicious_delicious_salt()
{
\$string = openssl_random_pseudo_bytes(3);
//Do I hash this? Do I generate a longer byte string and cut it?
return \$string;
}
``````

What I actually don't know

Does passing pseudo-random bits through a hashing algorithm and cutting a pseudo-random set of bits from the output produce high entropy bits?

I want to implement a salt-generating function for my SHA256 password hashes on my web server, and as an exercise in my own understanding I want it to be as cryptographically secure as I can reasonably make it without going crazy (and taking entropy encoded from HIDs (mouse, mic, video)).

• The answers here are good, but I'd like to just make the solution 100% clear - you don't need a strong random number generator, you just need to generate a unique value for a salt. A 32-bit integer that increments per-user, e.g. an auto-increment ID, is completely valid as a salt. Commented Feb 27, 2013 at 20:05
• Ah, thank you very much - a SQL database is involved, so I believe a 4-byte integer that increments automatically is very, very feasible/easy to implement.
– gal
Commented Feb 27, 2013 at 21:16

In key-stretching (which is pretty much what you're talking about), you aim to end up with a value that is time-expensive to reproduce. So you could take your 24 bit input, hash it `N` times where `N` is some integer large enough for the process to take several seconds on desktop hardware, and use the output for something.