New answers tagged

0

Nope, that's very much not a good idea. Just using the random salt from your step #1 is likely good enough. Section 4.1 of RFC 2898 provides recommendations for how to generate salts; the additional suggestion they make is that some applications will want to also have associated data pertaining to the encryption/decryption context. The problem with using ...


4

Why is using the password as part of the salt a problem? Because you need to store the salt separately from the hash of the password. You can either do this by encoding them in a specific way, such as storing them as $Rfc2898$iterations$mysalt$myhash or by using dedicated database tables. If you would go with the scheme you proposed (crating a random salt, ...


Top 50 recent answers are included