Letting Rfc2898DeriveBytes calculate the salt

Question

I've read a lot of posting here about Rfc2898DeriveBytes() and it seems that in all of them, the salt is pre-calculated and passed to the constructor. However, there is a constructor that accepts a salt length input, and the salt will be calculated for you. It is available afterwards in the Salt property.

Any disadvantage to letting the method calc the salt? In my case, the usage is for password hashing.

Answer 1

Specifying the salt length instead of the salt itself may reduce the chance of choosing the salt insecurely when deriving a new key (or obscuring a password for storage). The salt should be chosen by a cryptographic random bit generator, and should be changed each time the password is updated. Presumably, this constructor will use a high-quality RNG that was properly seeded. Leaving that up the the application allows for mistakes at worst, and at best creates unnecessary complexity.

Of course, if you are recovering a key, for example to check user input against the stored password, you'd need to specify the salt that was used initially.