If I'm using PBKDF2 to stretch a password into a suitable key for use in encryption with AES, should I be using a random salt (for PBKDF2, not the AES IV)?
Absolutely! It's even right there in the PKCS #5 v2.0
A salt in password-based cryptography has traditionally served the purpose of producing a large set of keys corresponding to a given password, among which one is selected at random according to the salt.
By using a secure salt, password
p1 = tomato will not produce the same key as
p2 = tomato even though they're the same password. This has two benefits:
- Protection against rainbow tables.
- Only one password can be attacked at a time. The same computational effort can't be utilized to "reverse" more than one password.
You must do this, as otherwise two users using the same password twice will generate the same key. The effort of using a salt is almost none, yet increases your security.
Please refrain from rolling your own there is a standard and you should use it!
It's healthy to question the "whys" from a learning perspective but playing with crypto and trying to cut corners can be dangerous if you are not an experienced cryptographer.