The aim is to generate a secure key for symmetric encryption.
I have a master password, from which I want to generate the key for symmetric encryption, in order to encrypt other passwords. The idea is to use PBDKF2 for the generation of that key.
This master password is pretty difficult to deduce, since I only store its sha256 hash. But the user provides it every time he logs in.
With the described scenario, I would say that I have a secure key for symmetric encryption, since it is not stored anywhere, and it can't be deduced with the information that it is stored.
So, my doubt is, is salting useful here? I cannot see it. I think that an empty salt would be ok.
Or maybe the scenario I'm considering has just any sense...