更简单的是——开发人员总是忽略这一点——如果您有唯一的用户 ID 或登录名，那么它们就可以完美地充当盐。 如果您这样做，您应该添加站点范围的盐，以确保您不会与具有相同好主意的另一个系统的用户重叠。
Most of these answers are a bit misguided and demonstrate a confusion between salts and cryptographic keys. The purpose of including salts is to modify the function used to hash each user's password so that each stored password hash will have to be attacked individually. The only security requirement is that they are unique per user, there is no benefit in them being unpredictable or difficult to guess.
Salts only need to be long enough so that each user's salt will be unique. Random 64-bit salts are very unlikely to ever repeat even with a billion registered users, so this should be fine. A singly repeated salt is a relatively minor security concern, it allows an attacker to search two accounts at once but in the aggregate won't speed up the search much on the whole database. Even 32-bit salts are acceptable for most purposes, it will in the worst case speed an attacker's search by about 58%. The cost of increasing salts beyond 64 bits isn't high but there is no security reason to do so.
There is some benefit to also using a site-wide salt on top of the per-user salt, this will prevent possible collisions with password hashes stored at other sites, and prevent the use of general-purpose rainbow tables, although even 32 bits of salt is enough to make rainbow tables an impractical attack.
Even simpler-and developers always overlook this-if you have unique user IDs or login names, those serve perfectly fine as a salt. If you do this, you should add a site-wide salt to ensure you don't overlap with users of another system who had the same bright idea.
Edit: My below answer answers the question as asked, but the "real" answer is: just use bcrypt, scrypt, or Argon2. If you're asking questions like this, you're almost certainly using tools at too low a level.
Honestly, there's no defensible reason not to have the salt be the same exact length as the hashed password. If you're using SHA-256, then you have a 256-bit hash. There's no reason not to use a 256-bit salt.
More than 256 bits won't net you any improvement in security, mathematically. But going with a shorter salt may always end up with a situation where a rainbow table catches up to your salt length -- especially with shorter salts.
The SHA2-crypt and bcrypt methods—used in Linux, BSD Unixes, and Solaris—have salts of 128 bits. These larger salt values make precomputation attacks for almost any length of password infeasible against these systems for the foreseeable future.
128-bit (16-byte) salt will be enough. You can represent it as a sequence of 128 / 4 = 32 hexadecimal digits.
发布评论
评论（5）
这些答案中的大多数都有点误导，并且表现出盐和加密密钥之间的混淆。 包含盐的目的是修改用于散列每个用户密码的函数，以便每个存储的密码散列必须单独受到攻击。 唯一的安全要求是它们对于每个用户都是唯一的，它们不可预测或难以猜测没有任何好处。
盐只需足够长，以便每个用户的盐都是唯一的。 即使有 10 亿注册用户，随机 64 位盐也不太可能重复，所以这应该没问题。 一次重复的盐是一个相对较小的安全问题，它允许攻击者同时搜索两个帐户，但总的来说不会加快整个数据库的搜索速度。 即使 32 位盐对于大多数用途来说也是可以接受的，但在最坏的情况下，它将使攻击者的搜索速度加快约 58%。 将盐增加到 64 位以上的成本并不高，但没有安全理由这样做。
在每用户盐之上使用站点范围的盐有一些好处，这将防止与其他站点存储的密码哈希发生可能的冲突，并防止使用通用彩虹表，尽管即使是 32 位的盐足以使彩虹表成为不切实际的攻击。
更简单的是——开发人员总是忽略这一点——如果您有唯一的用户 ID 或登录名，那么它们就可以完美地充当盐。 如果您这样做，您应该添加站点范围的盐，以确保您不会与具有相同好主意的另一个系统的用户重叠。
Most of these answers are a bit misguided and demonstrate a confusion between salts and cryptographic keys. The purpose of including salts is to modify the function used to hash each user's password so that each stored password hash will have to be attacked individually. The only security requirement is that they are unique per user, there is no benefit in them being unpredictable or difficult to guess.
Salts only need to be long enough so that each user's salt will be unique. Random 64-bit salts are very unlikely to ever repeat even with a billion registered users, so this should be fine. A singly repeated salt is a relatively minor security concern, it allows an attacker to search two accounts at once but in the aggregate won't speed up the search much on the whole database. Even 32-bit salts are acceptable for most purposes, it will in the worst case speed an attacker's search by about 58%. The cost of increasing salts beyond 64 bits isn't high but there is no security reason to do so.
There is some benefit to also using a site-wide salt on top of the per-user salt, this will prevent possible collisions with password hashes stored at other sites, and prevent the use of general-purpose rainbow tables, although even 32 bits of salt is enough to make rainbow tables an impractical attack.
Even simpler-and developers always overlook this-if you have unique user IDs or login names, those serve perfectly fine as a salt. If you do this, you should add a site-wide salt to ensure you don't overlap with users of another system who had the same bright idea.
编辑：我的下面的答案回答了所问的问题，但“真正的”答案是：只需使用 bcrypt、scrypt 或 氩气2。 如果您问这样的问题，几乎可以肯定您使用的工具级别太低。
老实说，没有任何合理的理由不让盐的长度与散列密码的长度相同。 如果您使用 SHA-256，则您拥有 256 位哈希值。 没有理由不使用 256 位盐。
从数学角度来看，超过 256 位不会给您带来任何安全性改进。 但是，使用较短的盐可能最终会导致彩虹表赶上您的盐长度的情况 - 特别是使用较短的盐。
Edit: My below answer answers the question as asked, but the "real" answer is: just use bcrypt, scrypt, or Argon2. If you're asking questions like this, you're almost certainly using tools at too low a level.
Honestly, there's no defensible reason not to have the salt be the same exact length as the hashed password. If you're using SHA-256, then you have a 256-bit hash. There's no reason not to use a 256-bit salt.
More than 256 bits won't net you any improvement in security, mathematically. But going with a shorter salt may always end up with a situation where a rainbow table catches up to your salt length -- especially with shorter salts.
目前可接受的哈希密码标准为密码创建了一个新的 16 个字符长的盐每个密码并将盐与密码哈希一起存储。
当然，应该采取适当的加密措施来创建真正随机的盐。
Currently accepted standards for hashing passwords create a new 16 character long salt for every password and store the salt with the password hash.
Of course proper cryptographic care to create really random salt should be taken.
一种答案可能是使用您要使用的哈希在安全性方面提供的值作为盐的大小。
例如，如果您要使用 SHA-512，请使用 256 位盐，因为 SHA-512 提供的安全性是 256 位。
One answer might be to use as size of salt the value that the hash you are going to use provides in term of security.
E.g. If you are going to use SHA-512 use 256 bit salt since the security provided by SHA-512 is 256 bit.
维基百科：
128 位（16 字节）盐就足够了。 您可以将其表示为
128 / 4 = 32十六进制数字序列。Wikipedia:
128-bit (16-byte) salt will be enough. You can represent it as a sequence of
128 / 4 = 32hexadecimal digits.