New answers tagged salt
0
Nope, that's very much not a good idea. Just using the random salt from your step #1 is likely good enough. Section 4.1 of RFC 2898 provides recommendations for how to generate salts; the additional suggestion they make is that some applications will want to also have associated data pertaining to the encryption/decryption context.
The problem with using ...
4
Why is using the password as part of the salt a problem?
Because you need to store the salt separately from the hash of the password. You can either do this by encoding them in a specific way, such as storing them as $Rfc2898$iterations$mysalt$myhash or by using dedicated database tables.
If you would go with the scheme you proposed (crating a random salt, ...
Top 50 recent answers are included
