TL;DR: How much can a function (such as the one below) modify an initially random string before that string becomes useless as a salt for password hashing? Is there a general rule?
# Function generates a random string of characters using urandom(), then converts each # character to its hexadecimal equivalent, and then converts *those* digits back to characters. # Each hexadecimal character-string is then concatenated into a super-string, excluding the '0x' # prefixes. The function returns the first 64 characters of the super-string. def hex_salt(): raw_salt = os.urandom(500) hex_salt = "" trimmed_salt = "" for i in range(len(raw_salt)): dec_num = ord(raw_salt[i]) hex_substring = str(hex(dec_num)) hex_salt += hex_substring j=0 while(len(trimmed_salt) < 64): if (hex_salt[j]=='0' and hex_salt[j+1]=='x') or (hex_salt[j]=='x'): j+=1 continue trimmed_salt+=hex_salt[j] j+=1 return trimmed_salt
The reason I ask is that I'm using python's built in hashlib module to set up a login service for my website. Because hexadecimal characters are easier to deal with, I want to create a random salt (using os.urandom) and derive an equally random salt from it containing only hexadecimal characters. This is my first post on here, so I apologize for whatever sins I've no doubt committed.