# Can a salt maintain pseudo-randomness after being modified?

TL;DR: How much can a function (such as the one below) modify an initially random string before that string becomes useless as a salt for password hashing? Is there a general rule?

``````# Function generates a random string of characters using urandom(), then converts each
# character to its hexadecimal equivalent, and then converts *those* digits back to characters.
# Each hexadecimal character-string is then concatenated into a super-string, excluding the '0x'
# prefixes. The function returns the first 64 characters of the super-string.

def hex_salt():
raw_salt = os.urandom(500)
hex_salt = ""
trimmed_salt = ""

for i in range(len(raw_salt)):
dec_num = ord(raw_salt[i])
hex_substring = str(hex(dec_num))
hex_salt += hex_substring

j=0
while(len(trimmed_salt) < 64):
if (hex_salt[j]=='0' and hex_salt[j+1]=='x') or (hex_salt[j]=='x'):
j+=1
continue

trimmed_salt+=hex_salt[j]
j+=1

return trimmed_salt
``````

The reason I ask is that I'm using python's built in hashlib module to set up a login service for my website. Because hexadecimal characters are easier to deal with, I want to create a random salt (using os.urandom) and derive an equally random salt from it containing only hexadecimal characters. This is my first post on here, so I apologize for whatever sins I've no doubt committed.

• There's no need to "derive" a random salt from your already-random salt. Just encode it directly as hex. That said, cryptographic hashes such as the ones offered by hashlib are unsuitable to use for passwords. Just use bcrypt. – Stephen Touset Jul 1 '15 at 22:32
• Thanks, that's really good to know! I'm basically teaching myself web development via internet resources, so a clear concise answer is a godsend. – AG Boling Jul 2 '15 at 0:35