If I'm using PBKDF2 to stretch a password into a suitable key for use in encryption with AES, should I be using a random salt (for PBKDF2, not the AES IV)?

  • You can leave out the AES IV if you use a per-message salt. But you should not leave out the salt even when you use an IV. Dec 12, 2013 at 15:03

2 Answers 2


Absolutely! It's even right there in the PKCS #5 v2.0

A salt in password-based cryptography has traditionally served the purpose of producing a large set of keys corresponding to a given password, among which one is selected at random according to the salt.

By using a secure salt, password p1 = tomato will not produce the same key as p2 = tomato even though they're the same password. This has two benefits:

  • Protection against rainbow tables.
  • Only one password can be attacked at a time. The same computational effort can't be utilized to "reverse" more than one password.

You must do this, as otherwise two users using the same password twice will generate the same key. The effort of using a salt is almost none, yet increases your security.

Please refrain from rolling your own there is a standard and you should use it!

It's healthy to question the "whys" from a learning perspective but playing with crypto and trying to cut corners can be dangerous if you are not an experienced cryptographer.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .